(IN) SECURE Magazine Issue 24

With a variety of high profile breaches like those at Google and Adobe dominating the start of
2010, I wonder what will the rest of the year bring in terms of cyberwar. Who was behind those
attacks is not as important as the fact that large companies admit to breaches publicly. Admitting
there's a problem is a significant step towards dealing with it. I expect more public disclosures and
a wider revelation of the issue. One of the following issues of (IN)SECURE will have cyberwar as
a theme, so if you have something to say about it, do let me know.
As concerns other content, expect coverage from several global events in the near future. As
silver media sponsors, once again weʼll be covering the extensive RSA Conference in San
Francisco. After that weʼre heading to InfosecWorld in Orlando and Infosecurity in London. Thatʼs
just in the next few months, we have a few more surprises lined up for the rest of the year.
Mirko Zorz
Editor in Chief
Visit the magazine website at www.insecuremag.com
(IN)SECURE Magazine contacts

Feedback and contributions: Mirko Zorz, Editor in Chief - editor@insecuremag.com
News: Zeljka Zorz, News Editor - news.editor@insecuremag.com
Marketing: Berislav Kucan, Director of Marketing - marketing@insecuremag.com
Distribution
(IN)SECURE Magazine can be freely distributed in the form of the original, non modified PDF
document. Distribution of modified versions of (IN)SECURE Magazine content is prohibited
without the explicit permission from the editor.
Copyright HNS Consulting Ltd. 2010.

www.insecuremag.com
25 million new malware strains in one year
The outstanding trend of the last 12 months has been the pro-
lific production of new malware: 25 million new strains were
created in just one year, compared to a combined total of 15
million throughout the last 20 years. This latest surge of activ-
ity included countless new examples of banker Trojans as
well as a host of rogueware.
As regards malware distribution channels, social networks

(mainly Facebook, Twitter, YouTube or Digg), and SEO at-
tacks (directing users to malware-laden websites) have been
favored by cyber-criminals, who have been consolidating underground business models to in-
crease revenues. (www.net-security.org/malware_news.php?id=1185)
Cybersecurity expert: Job guaranteed
With the proliferation of computer threats computer security has become one
whose experts are in great demand and has gained quite an aura of "cool-
ness".
According to the New York Times, the demand is for experts is great, but luck-
ily, some schools and universities are ready to train good candidates for the
job: the N.Y.U. Polytechnic, Carnegie Mellon, Purdue and George Mason are
just some of the universities offering a master's degree in cybersecurity. Georgia Tech is planning
to start an online degree in information security later this year.
(www.net-security.org/secworld.php?id=8677).
www.insecuremag.com ! ! 5
Rogue Android banking applications
Following a couple of announcements made in December by the likes of Travis Credit

Union and First Tech Credit Union, a big brouhaha was raised about some mobile
banking applications for Android-based mobile devices that seem to have been devel-
oped with the intention of phishing account and login information.
(www.net-security.org/secworld.php?id=8692)
Entrust updates PKI platform, adds Linux support
With the introduction of Entrust Authority Security Manager 8.0, Entrust cus-
tomers can implement one of the most trusted PKI security solutions available
on the Red Hat Enterprise Linux platform. This release introduces Entrust to the
open-source platform market and expands the potential overall installation base for the PKI solu-
tion. (www.entrust.com)
Continuing evolution of Internet threats
Spammers continue to be cutting-edge marketers,

this time taking advantage of the reputations of
global brands, such as UPS, DHL and Facebook, to
prompt opening of emails. These are the findings of
the latest Commtouch Internet Threats Trend report.
During this past quarter, cybercriminals focused on
distributing the Mal-Bredo A virus. While the number
of variants decreased from 10,000 to 1,000 as com-
pared to last quarter, it was spread with much more
virulence.
(www.net-security.org/malware_news.php?id=1198)
Software testing firm says no to responsible disclosure
Evgeny Legerov, founder of Intevydis, a Moscow-based company that designs

tools for testing software and provides pentesting and code review services, has
announced that the company has changed its position regarding responsible
disclosure policy and that they plan to make public a large batch of vulnerabili-
ties. (www.net-security.org/secworld.php?id=8702)
Top 10 information security threats for 2010
"The start of a new year is a great time for companies to evaluate their informa-
tion security practices and begin thinking about what threats they'll be facing in
the coming year," said Kevin Prince, CTO, Perimeter E-Security. "As these secu-
rity threats are becoming more serious and difficult to detect, it is vital for compa-
nies to understand what they can do to best protect their systems and informa-
tion. (www.net-security.org/secworld.php?id=8709)
Google hacked, plans to leave China
Although it does face a variety of cyber attacks on a regular basis, Google ac-
knowledged the theft of intellectual property following a sophisticated attack
on their infrastructure originating from China. Investigation of the incident un-
covered a more serious problem - at least twenty other large companies have
been targeted as well. These are not only IT companies but doing business in a variety of sectors
- finance, media, technology, etc. (www.net-security.org/secworld.php?id=8703)
Online cybercriminal DarkMarket closed, founder arrested
Who would have thought that Renukanth Subramaniam, a 33-year old

former pizza bar worker and dispatch courier, was the founder and one
of the site operators of DarkMarket, the famous cybercriminal forum-
slash-online market? And that his base of operations was a Java Bean
internet cafe in Wembley, London? But, yes - there was a hint that such
a thing is possible: Subramaniam (aka JiLsi) used to be part of Shad-
owCrew, a similar website that was closed down in 2004 by the US Se-
cret Service. (www.net-security.org/secworld.php?id=8718)
D-Link routers vulnerability allows hackers to reconfigure admin settings
SourceSec Security Research have discovered a vulnerability

in D-Link routers that allows outsiders and insiders to access
and edit the router settings without having to use admin login
credentials. This can be done because the routers have an
additional administrative interface, which uses the (inse-
curely) implemented Home Network Administration Protocol.
Just the fact that the HNAP is present on the routers is
enough to allow attackers to bypass the CAPTCHA login fea-
tures. (www.net-security.org/secworld.php?id=8727)
Networks Solutions breached, hundreds of sites defaced
Network Solutions, the well-known U.S. hosting provider and domain registrar
that manages over 6.6 million domain names, confirmed on Tuesday that their
servers have been breached and that a few hundred of their customer's web
sites have been defaced by unknown attackers who have replaced the home
pages with images of guns and writings containing anti-Israeli sentiments.
Encryption challenge worth $100K
News that an encrypted swiss army knife from manufacturers Victorinox remained
uncracked - and a $100,000 prize went unclaimed - at the CES in Las Vegas
comes as no surprise. And, says Andy Cordial, managing director of Origin Stor-
age, even if someone had cracked the 2010 version of the famous swiss army
knife, they would have obtained a lot more than $100,000 from other sources.
Analysis of 32 million breached passwords
Imperva released a study analyzing 32 million

passwords exposed in the Rockyou.com breach.
The data provides a glimpse into the way that users
select passwords and an opportunity to evaluate the
true strength of these as a security mechanism. In
the past, password studies have focused mostly on
surveys. Never before has there been such a high
volume of real-world passwords to examine.
Hiding from Google
Worried about Google tracking your online activity? Not satisfied with Tor's
speed? A (partial) solution to your problem has been set up by Moxie Mar-
linspike, a hacker that has a history of bringing to light SSL protocol weak-
nesses and a member of the Institute for Disruptive Studies, a group of hack-
ers based in Pittsburgh. He put together an proxy service he calls GoogleShar-
ing, that aims to anonymize all your searches and movements inside and from
Google online services that don't require you to login into your Google account.
Using spam to beat spam
How to make a spam filter that will not block any legitimate email? A team at
the International Computer Science Institute and the University of California
researched the ways that spam tricks existing filters and realized that spam
sent by botnets is usually generated from a template that defines what the con-
tent of the email and the changes it goes through to fool filters. They worked
under the conviction that this template might be discovered by analyzing the
multitude of emails sent by a bot. (www.net-security.org/secworld.php?id=8765)
Data breach costs increase
The 2009 Ponemon Institute benchmark study examines the costs incurred by 45 or-
ganizations after experiencing a data breach. Results represent cost estimates for
activities resulting from actual data loss incidents. Breaches included in the survey
ranged from approximately 5,000 records to more than 101,000 records from 15 dif-
ferent industry sectors. (www.net-security.org/secworld.php?id=8766)
US oil industry targeted by cyber attacks
ExxonMobil, Marathon Oil and ConocoPhillips are just three of the US companies
that have been breached in the last few years by cybercriminals that left some
clues pointing in the direction of the Middle Kingdom.
Hacker attacks on healthcare organizations double
SecureWorks reported that attempted hacker attacks launched at its healthcare

clients doubled in the fourth quarter of 2009. Attempted attacks increased from
an average of 6,500 per healthcare client per day in the first nine months of 2009
to an average of 13,400 per client per day in the last three months of 2009.
Digital fingerprints to identify hackers
How can you retaliate against a cyber attacker if you don't know who he is? As
we have witnessed lately, attribution of an attack is quickly becoming one of
the biggest problems that the US defense and cyber security community are
facing at the moment. DARPA, the agency of the US DoD responsible for the
development of new technology for use by the military - and of the Internet -
will be starting Cyber Genome, a project aimed at developing a cyber equiva-
lent of fingerprints or DNA so that the hacker can be conclusively identified.
IE vulnerability offers your files to hackers
Jorge Luis Alvarez Medina, a security consultant working for Core Security, has
discovered a string of vulnerabilities in Internet Explorer that make it possible
for an attacker to gain access to your C drive - complete with files, authentica-
tion and HTTP cookies, session management data, etc.
Tor Project infrastructure breached, users advised to upgrade
Tor users have been advised to upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha, follow-
ing a security breach that left two of the seven directory authorities compromised
(moria1 and gabelmoo). According to Roger Dingledine, Tor's original developer
and current Director, another new server has been breached along the previously
mentioned two, but it contained only metrics data and graphs.
Criminal found through World of Warcraft
It seems that law enforcement agencies are getting more crea-

tive with ways of leveraging dug up information about wanted
criminals. Using the knowledge of a previously seemingly incon-
sequential detail such as a game that the suspect is addicted to,
Matt Robertson, a sheriff's deputy from Howard County has
been able to zero in on the location of a man that has run off to
Canada to avoid getting arrested and charged for dealing with controlled substances and mari-
juana. (www.net-security.org/secworld.php?id=8667)
Since its inception in 1998, SOAP has become an essential part of virtually all
approaches to Web services. What started out as an acronym for ʻSimple Ob-
ject Access Protocolʼ, is a common solution for corporate information inter-
change today. However, many businesses fail when it comes to securing con-
fidential data during transfer across public networks. WS-Security offers
means for applying security to Web services and protecting private data.
I have been working for a German telephone SOAP Web services

company recently and my last project included
writing a secure Web service for electronic Dave Winer, Don Box, Bob Atkinson and
data interchange with PHP. In accordance with Mohsen Al-Ghosein originally designed SOAP
current legal provisions and historical devel- in 1998 with backing from IBM and Microsoft.
opments, the German Telecom owns the lionʼs SOAP once stood for ʻSimple Object Access
share of the domestic telephone network. But, Protocolʼ, but this acronym was dropped with
the law requires them to make the subscriber version 1.2 of the standard. Now SOAP is the
line available to competitors. brand name for a W3C recommendation, cur-
rently being maintained by the XML Protocol
Even though the German telephone market Working Group of the World Wide Web Con-
was liberalized in early 1998 to promote a self- sortium.
supporting competition, small and medium-
sized network carriers are still dependent on SOAP is a communications protocol for struc-
the German Telecom for clearance of local tured information interchange. It is based on
loop faults. In the past, facsimile communica- XML, allowing message negotiation and
tion was used to handle problems on the so- transmission. Furthermore, it is commonly be-
called last mile. Also, the German Telecom in- ing used for remote method invocation in dis-
troduced a SOAP gateway for electronic data tributed systems and large network environ-
exchange four years ago, aiming to streamline ments.
workflow and improve reliability.
www.insecuremag.com 10
Even though most standard stacks use a Authorization
combination of HTTP and TCP for data ex- Depending on the underlying application, a
change, SOAP is not bound to a specific ap- userʼs signature may be used for access con-
plication or transport protocol. Quite the control as well, e.g. validating a customer against
trary – it allows a wide variety of different pro- a back-end database. Thus a Web service
tocols for message transfer, e.g. SMTP or provider can allow or disallow execution of
HTTPS. certain transactions depending upon the re-
questerʼs identity.
Web service security
Confidentiality
To improve Web service security, the Organi- If you deal with sensitive information (e.g.
zation for the Advancement of Structured In- telephone connection data or customer-
formation Standards (OASIS) released WS- related records) and have to send them
Security 1.0 in April 2004. This protocol pro- across public networks, you might want to en-
vides additional means for applying security to crypt them beforehand. With SOAP, you can
Web services, namely by enforcing integrity either do this via HTTPS on the transport layer
and confidentiality. or use WSS/XML Encryption in the message
header. The latter method allows the encryp-
The specification describes how to attach se- tion of an entire SOAP message or single XML
curity tokens and digital signatures to the nodes only.
header of a SOAP message (including X.509,
Kerberos, SAML and XrML). Furthermore, Non-repudiation
WS-Security allows full or partial encryption of Both sender and receiver must be able to pro-
data. Since WSS is working in the application vide legal proof to a third party (e.g. judge),
layer, it ensures reliable end-to-end security. that the sender did send a transaction and the
receiver received the identical transaction.
The current WS-Security standard complies Usually non-repudiation is ensured by a com-
with a couple of well-established security re- bination of integrity, identification and authen-
quirements. The most important ones are tication.
listed below.
Suitable SOAP extensions for PHP
Integrity
All outbound messages can be signed digitally The official SOAP extension of PHP 5 can be
to ensure that the receiver takes notice of any used to write SOAP servers and clients. It
manipulation attempts during transmission, i.e. supports subsets of SOAP 1.1, SOAP 1.2 and
man-in-the-middle attacks. Moreover, it is WSDL 1.1 specifications. However it does not
possible to attach timestamps to all outgoing include any support for WS-Security yet.
SOAP messages in order to limit their time-to-
live. That way a service provider is able to While WSS is quite widespread among Java
prevent fraudulent use of his applications. and .NET developers, most SOAP libraries for
PHP lack a proper WSS implementation. Nei-
Identification ther NuSOAP (which is discontinued anyway)
Digital certificates and the WS-Security User- nor PEAR::SOAP offer built-in functionality for
name Token Profile help proving the identity of security-enabled Web services.
individual Web service consumers. Addition-
ally, HTTPS may also be used to safeguard a Actually, I did not find any appropriate SOAP
service against identity theft. implementation with WSS support for PHP
during my research. There are a couple of
Authentication third party solutions on the PHP Classes web-
In almost the same manner, certificates – no site (www.phpclasses.org), but none of them
matter whether they are embedded into the met my needs.
SOAP header or being used for HTTPS – can
confirm the identity of a Web service Furthermore, I wanted to go for the official
consumer. SOAP extension of PHP 5 for better upward
compatibility and less dependencies.
PHP library for XML security Altering outbound SOAP messages
Finally I found xmlseclibs on Google Code When sending a SOAP request over HTTP,
(code.google.com/p/xmlseclibs), which is a SoapClient::__doRequest() is called
PHP library for XML security. It is maintained internally. The function can be redefined in
by a developer called Rob Richards and offers subclasses to implement different transport
an object-oriented approach to use WS- layers or perform additional XML processing.
Security with PHP:SOAP. This means that we can exert influence on the
SOAP header being sent, simply by overriding
The official SOAP extension of PHP 5 consists the above-named method.
of two major classes for SOAP communica-
tion. The purpose of SoapClient is providing Through this mechanism xmlseclibs can en-
a client for SOAP 1.1 and SOAP 1.2 servers. It gage with the data interchange process of
can either run in WSDL or non-WSDL mode. PHP:SOAP. The following code listing shows
SoapServer can be used accordingly to write how this is done technically.
a server for the SOAP 1.1 and SOAP 1.2 pro-
tocols.
class SecureSoapClient extends SoapClient

{
public function __doRequest($request, $location, $action, $version, $one_way = 0)
{
// Create DOMDocument from SOAP request
$dom = new DOMDocument();
$dom->preserveWhiteSpace = false;
@$dom->loadXML($request);
// Create new XMLSecurityKey object and load private key

$securityKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1,
array('type' => 'private'));
$securityKey->loadKey(KEY_FILE_NAME, true);
// Create new WSS header object

$wssHeader = new WSSESoap($dom);
// Add Timestamp to WSS header (message expires in 5 minutes)

$wssHeader->addTimestamp(300);
// Sign message and appropriate header items

$wssHeader->signSoapDoc($securityKey);
// Create BinarySecurityToken from certificate and attach token to the header

$token = $wssHeader->addBinaryToken(file_get_contents(CERT_FILE_NAME));
$wssHeader->attachTokentoSig($token);
// Send SOAP message with WSS header and return response

return parent::__doRequest($wssHeader->saveXML(), $location,
$action, $version, $one_way);
}
}
First off we need to copy the current SOAP tach a BinarySecurityToken to the header suc-
request to a DOMDocument object. This facili- cessively. Finally we pass the arguments – in-
tates further adaptations to our needs. After- cluding our altered version of the SOAP re-
wards we can create a new XMLSecuri- quest header – to the correspondent method
tyKey object from our private key file. The in the parent class. Given that we will suc-
example uses RSA-SHA1 for encryption. Then ceed, the server will reply and send a re-
we instantiate WSSESoap, an additional class sponse to our request.
provided by Rob Richards, to create a WS-
Security header. This enables us to add a For a more comprehensive example, check
timestamp, sign the SOAP message and at- out Rob Richardsʼ website (cdatazone.org).
Server support still missing services in PHP. The software producer pro-
motes that his extension offers WSS support
Unfortunately, the ability to write a secure for both servers and clients.
SOAP server is still missing in xmlseclibs. Be-
cause my project was only supposed to con- But unless you want to develop a secure
sume a Web service securely, that was no SOAP server, I would recommend sticking to
problem for me. Affected developers might the official SOAP extension of PHP 5 and
want to take a look at WSO2 WSF/PHP xmlseclibs.
(www.wso2.com), which is an open source
framework for providing and consuming Web
EVEN THOUGH PHP STILL LACKS A COMPLETE WSS IMPLEMENTATION, FREE THIRD-
PARTY CLASSES PROVIDE A GOOD BASIS FOR SECURE DATA INTERCHANGE.
Conclusion Furthermore, HTTPS can help preparing a

SOAP Web service for business use.
WS-Security describes enhancements to
SOAP messaging and offers a wide range of Even though PHP still lacks a complete WSS
possibilities to protect a Web service through implementation, free third-party classes pro-
message integrity and single message vide a good basis for secure data interchange.
authentication. As a whole, these mechanisms By now my project operates in a live environ-
can be used to accommodate a variety of se- ment, serving a J2EE-based Web service and
curity models and encryption technologies. successfully conducting numerous transac-
tions every day.
Sascha Seidel graduated in computer science and works as a freelance developer in Germany. He is excited
about a wide variety of computer-related topics, ranging from front-end design to assembler coding. In his
spare time he maintains a community website for application, game and web developers
(www.planet-quellcodes.de).
Security technology has come a long way in the last 850 years, but we can
still learn a thing or two from our medieval ancestors. After the Norman
conquest of Britain, the new administrative centers and power bases of the
country were quickly strengthened against attack.
Hilltop fortifications were remade as imposing Why is this? Well, attack methods are chang-
stone castles, with multiple layers of security ing, and the dominant threat to endpoint secu-
built in. These protected the newly centralized rity now combines historically-effective attacks
trade and business operations against theft with newer, more elusive methods of delivery
and external attacks, and controlled third- and infection. As a result, attacks are ex-
party access – rather like the perimeter de- tremely difficult to stop, and more serious in
fenses, intrusion protection systems and consequence than previous exploits.
VPNs of a typical companyʼs network.
New, web-based attacks have emerged and
And if important figures left the protection of are becoming more common. And while tradi-
the castle, they would not only wear body ar- tional endpoint security controls are still im-
mor, but also carry a shield for additional, mo- portant, they are unable to fully cope with
bile defense against all types of weapon. But these new attacks, because they focus on the
do corporate endpoints – laptop computers wrong things.
and smartphones – have the same level of
protection? New controls are needed: web security must
extend to usersʼ behaviors as well as the PC
Unfortunately, it seems that unlike their me- software and configuration. Signature-based
dieval counterparts, modern mobile workers methods alone wonʼt stop new attacks, and
are no longer adequately prepared for attacks neither will simply removing malicious soft-
when they are away from the relative safety of ware.
the corporate ʻcastleʼ.
What are these new approaches? Letʼs see in Below the radar
detail at how enterprise attack vectors are
changing and evolving, the motivations be- Hacking has evolved from the attention-
hind them, and how they get around tradi- grabbing viruses of nearly a decade ago to
tional endpoint security approaches. the more covert and dangerous affair it is to-
day. The result is that enterprises face more
Following this, I will look at a new approach to daunting online threats today, yet are often
protecting endpoints against these attacks, less equipped to handle those threats.
both reactively and pre-emptively.
In the early 2000s, hacking was generally
Battle beyond the browser characterized by a drive for attention, not fi-
nancial motivation. Though sophisticated Tro-
One of the key malware developments over jan and other attack technology was around, it
the last 5 years is the move from email-borne was rarely deployed—especially not for finan-
to web-borne attacks. Exposure can occur if a cial gain.
business PC is used for business or personal
use on the web. E-mail worms were the norm, and they were
widely reported in the press. They had a
The issue is, organizations often have a false widespread, positive impact: many organiza-
sense of security, because traditional controls tions responded by deploying desktop and
for protecting enterprise endpoints do not se- gateway security applications such as
cure against web-based threats. Hereʼs a signature-based antivirus products and fire-
small sample of recent incidents in which walls, and – crucially – regularly updating ex-
criminal hackers have used the Internet as a isting security solutions to keep them ahead
platform to distribute their wares: of malware authors.
• In July 2009 web services provider Network But with changing motivations come new
Solutions disclosed that hackers broke into its techniques that take a different approach. So-
servers and stole details of over 573,000 debit phisticated blended threats have joined the
and credit card accounts from its customers. universe of viruses, Trojans, worms, and other
The company discovered in early June that its exploits and expanded attack possibilities be-
servers had been hacked into by unknown yond the reach of older exploits.
parties. The servers provide e-commerce
services such as Web site hosting and pay- New web-based attacks have three key prop-
ment processing to nearly 4,500 small to mid- erties:
size online stores. The hackers left behind
malicious code, which allowed them to inter- • Threats are much less noticeable because
cept financial information from people who they are designed to be silent on the victim
made purchases at the online stores hosted PC. Only a loss of PC performance or stability
on those servers from March to June 09. might be apparent.
• In June 2009, more than 40,000 web sites • Threats are targeted and sent in small
were hit by a mass-compromise attack batches to avoid detection. Itʼs now rare to
dubbed Nine Ball that injected malware into see major headlines accompanying a threat –
pages and redirected victims to a site that at- the exception being this yearʼs Conficker out-
tempted to download further malware. break, which still has AV researchers puzzled
as to motive.
• May 2009, a series of rapidly spreading web
site compromises known as Gumblar gar- • Consequences are serious and may in-
nered media headlines. Gumblar-infected clude personal data loss/identity theft, as well
sites delivered keyloggers and other malware as the silent takeover of individual PCs to
to visitors. create botnets—thousands of computers that
can be controlled at once to launch large-
scale attacks.
Web-based attacks include “drive-by” down- solutions had difficulty keeping up with attacks
loads, PHP and AJAX exploits—all retaining a decade ago, and this was before modern
the worst characteristics of the recent past. automated, morphing and small-batch custom
They remain financially motivated, extremely attacks were available.
damaging, and relatively silent and unnotice-
able. Like earlier threats, they are once again In the face of modern attackware, it is no
viral and widely distributed. wonder that experts and analysts have written
hundreds of articles predicting the decline and
Many enterprises assume they already have death of antivirus.
sufficient Internet security to prevent these
web-based attacks—but remain unprotected. As these observers point out, antivirus soft-
Unfortunately, most providers of endpoint se- ware reacted too late for “Melissa” in 1999,
curity software do not yet offer the appropriate and for “I Love You” in 2000—all of which
controls to prevent exploits by todayʼs web- were mass-mailed, relatively low-tech (slowly
based threats. Letʼs look at why this is. morphing) viruses. How can antivirus (and its
cousins anti-spyware, IDS and similar) keep
New threats get the upper hand up with todayʼs viruses and worms that are
blended, and more advanced?
PC-based security software – whether a
single-user suite or a corporate endpoint solu- The truth is, they canʼt. Recently, threats have
tion – is still critically important, but is no appeared in small batches (thousands, not
longer enough to combat these new web- millions of infections) that constantly morph,
based attacks. Each type of solution arguably change their signature on every PC they hit,
falls short in at least one important way. and stay hidden.
Signature solutions While antivirus, anti-spyware and similar se-

curity solutions are useful for “cleanup duty” in
This category of solution includes PC-based the aftermath of an attack, they are ineffective
forms of security such as antivirus, anti- as a defense for some zero-hour web-based
spyware and signature-based IPS. Signature attacks.
PC-based security software is still critically important, but is

no longer enough to combat new web-based attacks.
Firewalls When the user initiates an HTTP connection,

the firewall acts as a wide-open highway that
Desktop firewalls are effective against zero- brings traffic straight onto the PC. Most stud-
hour, morphing, and targeted network attacks. ies show that spyware and other malware ex-
They follow a simple and elegant rule: do not ists on over 80% of PCs running firewalls.
allow any traffic onto the PC unless the user
and/or administrator specifically allow it. Firewalls are focused on protecting usersʼ
computers, not usersʼ behavior. Similarly, they
This “reject all unless known good” rule is in do little to prevent direct online contact with
direct opposition to the signature rule of “allow malware.
all except known bad.” However, there are a
couple of downsides to desktop firewalls. Desktop firewalls continue to be critical com-
ponents of endpoint security because they
First, they generally allow user-solicited traffic provide network-based protection in a way
on TCP port 80, the standard port used for that nothing else can. When it comes to web-
HTTP traffic. based attacks, however, they are not fully ef-
fective.
The need for new security controls requires making ongoing decisions about both
systems—something that the average enter-
In the face of modern web attacks, new prise user is unwilling or unable to do.
signature-based security solutions have
emerged that try to protect users online. Method-blocking systems: This technology
These new transaction security products use focuses on one or more known browser vul-
signatures of known bad web sites, including nerabilities that allow hackers to target users
phishing sites and spyware distribution sites. with malicious code. For example, cross-site
Some also contain signatures of malicious scripting presents a vulnerability that enables
web site behaviors. This information allows a hacker to inject malicious code into other
them to identify and prevent users from visit- peopleʼs web pages.
ing web sites at a more general level, and
keep a more secure environment. A method-blocking system actually interferes
with this feature, thus removing the method by
These signature solutions are the first re- which these attacks can be carried out. While
sponse to the new attack types, yet they are these systems are important and necessary,
not the most effective. They work as partial their shortcoming is that they block only some
solutions but are no match for the threat envi- methods of attack (usually just one), and
ronment described earlier, in which hackers therefore cannot stand on their own against
design dynamic, morphing threats that get the sheer breadth of tactics that web-based
past signature systems. Just as todayʼs vi- attacks employ.
ruses can bypass antivirus systems, modern
web attacks evade these signature-based So how are these combined to give the best
web transaction security products. protection against newer attacks?
This means supplementing the traditional se- Stopping all Web-based attacks
curity ʻarmorʼ for endpoints (firewalls, antivi-
rus, anti-spyware and so on) with additional The first step is taking the correct approach to
protection specifically for the web browser virtualization – that is, choosing the right ele-
application. ments of the OS and relevant applications to
virtualize.
Just as medieval noblemen would carry a
shield to stop attacks before they hit the body, The aim of virtualization is to protect the
so the web browser needs a shield to absorb userʼs web session by enclosing it in a “bub-
attacks, and protect identities and data ble of security” as they browse – while keep-
against both high-profile and stealthy infiltra- ing the process simple and transparent for the
tion attempts. user. Itʼs a process that can be called preci-
sion emulation.
The ʻvirtual shieldʼ
With this approach, only those parts of the
There are several technologies that have operating system that the web browser is able
emerged to fight web-based attacks without to access need to be virtualized. This means
the use of signatures. These can be classified that there is no large installation, much less
into two broad categories: system memory use and associated perform-
ance degradation, and no need for the user to
Manual virtualization systems: These systems keep track of multiple operating systems or
virtualize all or a part of the host computer, file systems. The virtualization engine should
and require that all changes from the Internet also automatically maintain the virtual system
to the PC take place in the virtualized system it creates.
itself. In this way, nothing harmful can transfer
from the Internet to the PC. For example, each time a user browses the
web, a number of changes—most of them in-
While this seems like an elegant solution, it nocuous—are made to their computer
requires the maintenance of both a virtual system.
machine/file system and an actual one. It also
A specific case is when processing an online sion, the virtual layer can be reset and
form to become a registered user of a web scrubbed to a clean state.
site, often the siteʼs server creates a cookie
that is placed onto the userʼs computer. Without this approach, user accounts often
run with administrative privileges, giving ap-
Under precision emulation, the virtualization plications freedom to read and write to the
engine should follow a very simple, firewall- operating system and kernel. This allows ma-
like rule. All user-solicited downloads from the licious code to directly access and harm the
Internet write to the computer just like normal. operating system.
But unsolicited downloads such as drive-bys
write to the emulation layer, never touching Web shield benefits
the computer.
To conclude, placing a virtual shield around
The result is that users can browse to any the browser has three core security benefits.
web site and click on any link without worry
because all unknown or unwanted changes 1. It is signature independent: itʼs a zero-hour
(from browser exploits and drive-by down- system that employs a simple firewall-like
loads, spyware, and viruses) are made to a rule: reject all changes to the userʼs PC
virtualized file system. So only the items the unless the user specifically solicits them.
user purposely downloads are placed on the
endpoint PC. 2. It protects the userʼs PC from the moment
of connection: as web-based attacks can oc-
A closer look at precision emulation cur the moment the user encounters a web
site, the shield approach does not passively
Precision emulation works by intercepting Mi- wait for malware to transfer from the Internet
crosoft Windows interfaces to directly access to the PC. The virtualization layer shields the
files and registry keys. In doing so, the proc- user immediately and through the whole
ess creates two major components: session.
• A virtualization engine to creates a duplicate 3. Itʼs unobtrusive: no special setup or main-

Windows file and registry system tenance on the part of the enterprise adminis-
• A hooking engine to selectively redirect NT trator is needed, and all virtualization activity
kernel calls to the virtualization engine. is invisible to the user and requires zero main-
tenance.
The purpose of the hooking engine is to inter-
cept indiscriminate NT kernel calls. At this The latest generation of web-based attacks
point, it decides if a kernel call was solicited need a solution that supplements and goes
by the user or was automatic, as in a drive-by beyond the best of traditional endpoint de-
download. The engine determines this based fenses, including signature-based security,
upon whether or not expected UI calls were updates to virus and spyware eradication
made (user initiated) or not (automated, mechanisms, and firewalls. It needs to shield
drive-by). the browser – the userʼs point of contact with
the Internet – from the endpointʼs operating
User-solicited calls are made to the native system and file system, to stop unauthorized
system component as always, so as not to changes.
interrupt the userʼs normal workflow. Unsolic-
ited calls, however, get applied to the virtuali- After all, if youʼre going to put armor on your
zation engine and virtual file and registry sys- endpoints, why not do what our medieval
tem, and therefore never reach the actual ancestors did, and use a shield as well?
computer. At the end of each browsing ses-
Caroline Ikomi is the Technical Director at Check Point (www.checkpoint.com).
How many times have you, as a security professional, explained to your
friends, family or colleagues that using one password for everything is not
ideal and not secure - far from it, actually? Yet the report by CPP suggests
that many Brits do exactly that! A typical response from those “offenders” is:
“It is impossible to remember all those passwords. That is why I use just one
strong password.” Obviously, we know it does not really matter how strong
that one password really is!
In this article I will show you a sensible, af- This software operates as a vault on your Mac
fordable and working solution for those who and has plug-ins into major browsers on Mac.
have a Mac and even an iPhone. I will also My workflow is now as follows:
show how I use 1Password for all my pass-
word management, storing sensitive data and 1. Go to a registration page
having all that accessible on my iPhone. I 2. Fill in my details, username etc - I use
cover the latest version of 1Password 3 which 1Password to fill in my personal details
has been released in November 2009. 3. Click on 1Password icon and select Strong
password generator (I always select the
My life with 1Password strongest password the website supports)
4. Click Submit in the web form and 1Pass-
Before I stumbled upon 1Password I had used word asks me to save the form into its data-
ʻremember passwordʼ feature in Safari or Fire- base.
fox. This worked fine for web passwords but
was rather limited in functionality. I usually Next time I need to login to the website I sim-
struggled with generating new passwords for ply click the 1Password icon and select Fill the
new websites. The option was either using login. I usually use Autosubmit so I do not
one password (oops) or using external pass- even need to click Submit on the web form.
word generators. And then I discovered (See the figure on the following page).
1Password!
Strong password generator very easy to understand. In the Advanced sec-
tion you can choose pronounceable password
The biggest advantage when using 1Pass- or random. I always use random as I really do
word is that it can generate strong and unique not need to remember the website password.
passwords for each website. The dialogue is
The random option can be set to generate a It can also generate a password with only dig-
defined number of digits or symbols. This is its if I choose same number of digits as the
useful when generating passwords for sites password length (limited to 10 digits length).
that do not support symbols in the password
field.
1Password interface
• Secure notes - Mac OS provides Sticky
Although this is not the review of the design Notes for storing unstructured information.
features of 1Password, I just want to present Secure Notes is similar, except it is protected
one screenshot of the interface. This shows by 1Password security.
the types of items in the Vault:
• Software - This is a new feature of 1Pass-
• Logins - this contains all web sites that I word 3. Simply drag and drop an application
saved the password for from Applications folder and 1Password will
create a new entry, identify the version num-
• Accounts - this feature stores password and ber and add the icon. I use this feature to
account information for non web based serv- store all software licenses.
ices, like FTP servers, wireless networks,
emails accounts, databases. Although 1Pass- • Wallet - Another handy feature to fill in credit
word cannot automatically fill in the details, cards effortlessly to a web page for payments.
you can copy and paste the information easily. Works 99% of time, with same caveats as ex-
plained in Identities.
• Identities - I am fed up with registering on
new websites and filling all details again and Behind the scenes
again. Identities allow me to create multiple
identities and then easily fill in the details to a 1Password 3 uses its own keychain type
website. The results are not ideal all the time, which offers advantages compared to the Mac
mainly because the standards for naming OS X Keychain. See the table on the following
conventions of forms elements are not fol- page, taken from 1Passwordʼs website.
lowed all the time.
When using the Agile keychain, each entry is ewyi9+RoYqtuSslg==\u0000","typeName":"we
a file on the file system. See the screenshot bforms.WebForm","openContents":{"contents
below. Here is how the file is structured. The Hash":"39105b88","passwordStrength":46,"us
encryption key for the data is derived from the ernameHash":"dad1289817469123481649643
master password that is used when unlocking 845244cdf76fed50a84","securityLevel":"SL5","
the keychain. passwordHash":"673f12f43886923487592347
592345b2c221678cc710f24"},"location":"https:
{"keyID":"4E0D436BBF524E47222234102707 //consulting-jobs.theweb.co.uk","uuid":"0CBD0
B514FF1","locationKey":"theweb.co.uk","encry B9345793456B423D5B160","updatedAt":1215
pted":"U2FdfRsjddsk463jdgso38hhLNsdGVkX 729057,"createdAt":1215729057,"title":"test
19jB7GLg2kw+hlRjZEETUNyom8zwACz8rliN/ Web","folderUuid":"F0CFF318736744349AC9
/BATiS7tbersko8r7lqwehro132iqwegfo8132db 3FC0F004741E"}
Configuration options 1Password preferences. Here you can set an

auto-lock of 1Password keychain after a cer-
Some indication of 1Passwordʼs qualities can tain time, computer sleep or when screen-
be demonstrated by the screenshot of the saver is activated.
The option “Never prompt for master pass- user logs in. While Keychain provides strong
word” is useful for some as it will save 1Pass- security I prefer to unlock 1Password manu-
word master password in the Mac OS X Key- ally.
chain. This is automatically unlocked when the
1Password Anywhere memory stick or put in online storage and

used from a web browser. This allows users to
One feature that I do not use but maybe useful access all information in 1Password from any
for other users is 1Password Anywhere. As I modern web browser. The web interface looks
explained before, the 1Password chain is a almost exactly the same.
folder. This folder can be copied on a USB
Once unlocked, you can read all information, cially true on complex websites where the
but no changes are allowed to the content of login or registration form is driven by java
1Password. It would not be wise to have the script. I have had some websites that simply
1Password data in many places as it is still did not work. To the credit of the developers I
vulnerable to offline password cracking at- must say that they promptly checked the web-
tacks. Hence, the master password complexity site and sometimes updated the software in
is key to the security of your 1Password data. the next versions.
The problems 1Password on the iPhone
1Password works very well in most cases. The I do not always have my Mac with me, but I do
trouble begins with indexed passwords. Take have an iPhone. The perfect companion to
Direct Line as an example. To login to their 1Password on my Mac is 1Password Touch
system you have to enter your email address Pro. This application synchronizes all 1Pass-
and postcode. Then on the next page you are word data to the iPhone.
asked to enter the 2nd and 4th character from
your password (for example). 1Password has The security model is slightly different here.
no way of knowing which character the web- The entry to the 1Password Touch application
site wants. In this case, the workflow is little is secured by 4-digit passcode.
more complicated. I need to open 1Password,
look up the website entry and display the Each entry in the 1Password database then
password for it. has a flag to indicate whether another pass-
word is needed to unlock this entry in1Pass-
Another issue I have with the software is that it word Touch application.
does not work well all the time. This is espe-
The master password on the iPhone applica- The usage of 1Password Touch is straightfor-
tion is independent from the Mac version and ward, with nice features like integrated web
is set when 1Password Touch is installed and browser with auto-logon capability or copy and
run for the first time. In order to access highly paste.
sensitive information, you need to enter 4-digit
passcode and then the master password. If It securely synchronizes with the desktop ap-
you feel nervous about having sensitive infor- plication using the Bonjour protocol. The sync
mation on your iPhone, you can select only setup is relatively easy.
some folders as seen on the following
screenshot.
Conclusion The introduction of the iPhone Pro version in

the App Store has enhanced my ability to login
I have been using 1Password for over a year to my websites securely from anywhere.
now and I am impressed with this product. It
has its glitches, but overall I am very satisfied.
Vladimir Jirasek is an experienced security professional currently working as the Security architect in Nokia UK
Ltd. He holds CISSP- ISSAP, ISSMP, CISM and CISA and is the member of the ISSA UK chapter. He can be
reached at vladimir@jirasek.eu and on LinkedIn http://uk.linkedin.com/in/vladimirjirasek
With todayʼs extensive use of web applications to optimize and digitize the
key processes of companies, most of the sensitive information of the organi-
zation, including customer private data, corporate secrets and other informa-
tion assets that are in danger of being exposed on the Internet.
Identifying the level of risk those applications • Where should application security testing
represent for a company is a primal task for start?
information security officers. In an ideal world, • Which applications are most critical to the
one would be able to look for security bugs in company?
every single application in the companyʼs in- • What kind of testing method should be
ventory to determine the companyʼs overall used?
security position. • What tool is best for the job?
• What verification requirements should be
However, full-blown testing would be over- considered for the application security policy?
whelming and too expensive. At the same
time, a timid approach could leave the organi- There are no straight answers to these ques-
zation exposed to a security breach, which tions, as an effective approach should be tai-
may lead to financial and reputation losses. lored to the specific needs and goals of the
organization and its industry.
A balanced approach is the best way to ade-
quately protect and safeguard the most impor- What are the biggest risk levels within the
tant company assets first. It provides the application portfolio?
overall picture of the companyʼs information
assets exposure and allows the company to The first part of the strategy should be to de-
make the right decisions regarding where the fine what applications pose the highest risk for
fixing efforts should be spent. This article will the business and, thus, have the highest po-
share some key tactics that can help answer tential to produce financial loss in the event of
the following questions: a security breach.
Identifying those applications is not an easy • Data exposure. This is determined by how
task. However, some well-known key indica- accessible the information is for unauthorized
tors could be used as guidelines for ranking: users. Things to consider include where the
application is hosted, (internally or a hosting
• Data sensitivity. All the privileged data of the service), its accessibility through the Internet
company, such as intellectual property (IP), (Is it an open Internet app or is it an Extranet
which, if leaked, might damage the organiza- app?), access restriction (IP restricted, named
tionʼs competitiveness. people, VPN).
• Private user data. Disclosure of customer • Potential financial/economic loss. How much
sensitive information, like credit card informa- would it cost the company if this application or
tion, social security numbers or salary, is a its data is compromised?
common cause of big losses, as there are
both legal and economic implications. Identifying riskier applications
• Compliance requirements. Rules and regula- A widespread approach to ranking applica-

tions, such as SOX, PCI, GLBA or HIPPA, re- tions by criticality is the use of a common risk
quire additional rigor which may increase the analysis formula. This is aligned to the finan-
complexity of application security and data cial loss that might result in the case of a se-
management. curity breach.
The formula is appealing due to its simplicity. more sensitive the data, the higher the finan-
The problem, though, is that both probability cial loss, we can use two components that
and impact are discrete values that are diffi- can be easily measured (information expo-
cult to measure. But if we take the fundamen- sure and sensitivity), and end up with a for-
tal premises that the more exposed the data mula that looks like this:
is, the more prone it will be to attack—and the
The outcome is pure gold: a simple formula A good practice is to use a reduced number of
that can help to quickly prioritize applications values for both factors (anything between 3 to
for testing and – as we will see later – also 10 levels) and to group Overall Application
help to identify what kind of testing should be Criticality based on value ranges.
used for each type of application.
Such is the case in the following example, in
Like everything else in application security, it which we use values from 1-4 for exposure
is not bullet-proof. But it is simple and effec- and sensitivity, and then we group them ac-
tive enough to simplify the task of application cording to the results and the following crite-
risk categorization with a good level of accu- ria: Low (1-2), Medium (3-5), High (6-8), and
racy. Critical (9-16).
Table 1: Application Criticality Matrix.
Selecting the right testing approach • Timing. At what point(s) in the SDLC will the
assessment be performed? (Rule of thumb:
Once an Application Criticality Matrix has the earlier, the better)
been established, you may opt to focus first • Manual, automated or “hybrid” testing?
on those that, as a result of the assessment,
have been classified in the levels of High and To identify the best suited approach, OWASP,
Critical. Now it is time to determine the kind of a worldwide community focused on improving
testing that should be used, choosing be- security of application software, has published
tween a wide range of approaches: the Application Security Verification Standard
(ASVS), which serves as a great starting
• Depth vs. breadth. Penetration testing or point. ASVS defines four levels of Web appli-
vulnerability assessment? cation security verification: Automated, Man-
• Inside-out vs. outside-in. Do you want to ual Review, Design Verification and Internal
know the insider threat level or the outsider Verification. Each level includes a set of re-
one? quirements for verifying the effectiveness of
security controls that are being used.
The single tool trap security testing, trying to create a strategy
around one particular tool may be a mistake.
Scanning tools are an essential part of every The application security testing strategy
AppSec strategy, and so is choosing the right should leverage the right tools, at the right
one. Fortunately, ASVS provides enough place and time.
guidance on what vulnerabilities a tool should
be able to look for. Verification requirements in the applica-
tion security policy
No one tool can do everything well. According
to an evaluation on application security scan- This OWASP ASVS standard provides
ning tools, carried out by the US NSA Center enough information to help define a basic set
for Assured Software, the best coverage one of verification requirements that include cov-
can get with a single tool is detection of erage, rigor and testing methods. With that in
60.3% of the vulnerabilities of an application. place, it is time to map it to the recently-
Other studies show similar or lower rates. created Application Criticality Matrix. For
While tools are very useful and necessary for example:
attaining good efficiency levels in application
Note: This is an over-simplified table intended to exemplify the mapping activity.
Take into account that the requirements set using the results of applying risk rating crite-
should not be limited to new and existing de- ria. Add it to any existing application or infor-
velopments; organizations should also con- mation security policies, and communicate the
sider major and minor improvements, acquisi- changes to the company. It is not until this
tions, and outsourced developments. All the point that the “dirty” work of testing the appli-
applicable cases, and the periodicity for the cations should start.
requirements to be re-verified, should also be
taken into consideration. There is much more to be done for an appli-
cation security program to become a real and
Summary full-blown solution for any company; however,
these guidelines can serve as a starting point.
An Application Vulnerability Detection Strat- Once a detection strategy has been laid out,
egy should be composed by three elements: teams should start to gather valuable informa-
Application Criticality Matrix, suitable testing tion on vulnerabilities, and then it may be a
approaches and verification requirement set. good time to consider implementing a metrics
Once the detection strategy has been cre- program.
ated, it is time to sell it to top management
Juan Carlos Calderon is the Information Security Research Leader for Softtek (www.softtek.com) and is
CSSLP certified. With nine years of experience working in the application security arena for international com-
panies, his responsibilities include (among others) penetration testing and security code reviews for hundreds
of applications in the Financial, Energy, Media, Aviation and Healthcare industries. He is an active participant
at renowned OWASP project.
CompTIA Network+ Certification Study Guide: Exam N10-004, Second Edition
By Robert Shimonski
Syngress, ISBN: 9781597494298
CompTIA's Network+ exam (N10-004) is a major update with more focus on

security and wireless aspects of networking. This study guide has been
updated accordingly with focus on network, systems, and WAN security and
complete coverage of today's wireless networking standards. This book covers
the core Network+ material including basic design principles, management
and operation of a network infrastructure, and testing tools. After reading this
book not only will you be able to ace the exam but you will be able to maintain,
troubleshoot, and install computer networks.
Inside Cyber Warfare: Mapping the Cyber Underworld

By Jeffrey Carr
OʼReilly, ISBN: 0596802153
Maybe you've heard about "cyber warfare" in the news, but do you really know
what it is? This book provides fascinating and disturbing details on how nations,
groups, and individuals throughout the world are using the Internet as an attack
platform to gain military, political, and economic advantage against their
adversaries.
You'll learn how sophisticated hackers working on behalf of states or organized

crime patiently play a high stakes game that could target anyone, regardless of
political affiliation or nationality.
Cloud Security and Privacy
By Tim Mather, Subra Kumaraswamy, Shahed Latif
With Cloud Security and Privacy, you'll learn what's at stake when you trust
your data to the cloud, and what you can do to keep your virtual infrastructure
and web applications secure. This book offers you sound advice from three
well-known authorities in the tech security world. Ideal for IT staffers,
information security and privacy practitioners, business managers, service
providers, and investors alike, this book offers you sound advice from three
well-known authorities in the tech security world. You'll learn detailed
information on cloud computing security that-until now-has been sorely lacking.
The Official Ubuntu Book (4th Edition)

By Benjamin Mako Hill, Matthew Helmke, Corey Burger
Prentice Hall, ISBN: 0137021208
Written by expert, leading Ubuntu community members, this book covers all
you need to know to make the most of Ubuntu 9.04, whether youʼre a home
user, small business user, server administrator, or programmer.
The authors cover Ubuntu 9.04 from start to finish: installation, configuration,
desktop productivity, games, management, support, and much more. Among
the many topics covered in this edition: Edubuntu, Kubuntu, and Ubuntu Server.
Eleventh Hour Security+

By Ido Dubrawsky
Syngress, ISBN: 9781597494274
This book focuses on just the essentials needed to pass the Security+
certification exam. It's filled with critical information in a way that will be easy to
remember and use for your quickly approaching exam. The title contains easy
to find, essential material with no fluff - this book does not talk about security in
general, just how it applies to the test. The author, Ido Dubrawsky, is the Chief
Security Advisor, Microsoft's Communication Sector North America, a division
of the Mobile and Embedded Devices Group.
Hacking: The Next Generation

By Nitesh Dhanjani, Billy Rios, Brett Hardin
With the advent of rich Internet applications, the explosion of social media, and
the increased use of powerful cloud computing infrastructures, a new
generation of attackers has added cunning new techniques to its arsenal. For
anyone involved in defending an application or a network of systems, Hacking:
The Next Generation is one of the few books to identify a variety of emerging
attack vectors. You'll not only find valuable information on new hacks that
attempt to exploit technical flaws, you'll also learn how attackers take
advantage of individuals via social networking sites, and abuse vulnerabilities in
wireless technologies and cloud infrastructures.
Collaboration and socializing, flexible and movable content, interoperability -
these are all things that made Web 2.0 the answer to our needs. New tech-
nologies to sustain this evolution are introduced almost daily, but we should
not be so naive to think that attackers won't be able to find ways to compro-
mise and take advantage of them and us.
Stefan Tanase, senior security researcher of jecting iFrames or JavaScript for delivering
Kaspersky's Global Research and Analysis exploits.
Team, ventured a few predictions for the evo-
lution of threats that await us in 2010. He But what about the future? There are 4 differ-
started by summarizing the current situation: ent combinations of threats and web applica-
tion that we can expect:
• 2009 saw the Internet become the biggest
infection vector - most of the infections are not • Old applications, old threats = old news
coming from instant messaging platforms, • New applications, old threats = predictable
peer-to-peer networks or email, but directly • Old applications, new threats = more or less
from the Web (through web applications). predictable
• New threats, new applications = the
• 1 in 150 websites is currently spreading in- Unknown (mostly).
fection - and these are no longer websites
created for the specific purpose of spreading New applications, old threats
malware, but legitimate websites that got
breached through compromised FTP ac- Cross-site scripting in the Google Wave appli-
counts, which were the point of entry for in- cation is a good example.
Spam and phishing scams will follow all new tion files and improved communications infra-
popular applications because the bigger the structure (possibly peer-to-peer architecture).
target pool is, the bigger the chance of suc-
ceeding will be. New applications will bring AV detection rates will start to matter because
more unwanted content and offer more space they will start targeting more experienced us-
for criminals to maneuver in and spread mal- ers - users who keep their software up-to-
ware, and new, improved Koobface modules date. Because of this they will probably start
to target them. encrypting the packets to avoid detection and
to make the analysis process harder. And, fi-
Old applications, new threats nally, technical exploits will be developed and
used in addition to social engineering.
New features will be exploited. Koobface will
evolve - encrypted or obfuscated configura-
Spam and phishing scams will follow all new popular applications because the bigger the tar-
get pool is, the bigger the chance of succeeding will be.
New applications, new threats These attacks will be localized, contextualized

and personalized.
It is, of course, difficult to predict which new
threats will rise from new, yet unknown appli- What can we do about it?
cations because we can't possibly know what
the features will be or what they will be de- We should use a fully featured Internet secu-
signed to do. rity solution, an up-to-date browser, and al-
ways the latest versions of software that has
But, as more and more personal information historically proved to be very vulnerable (e.g.
becomes public on social networks, it will be Flash Player, Adobe Reader, etc.).
used to execute targeted attacks. Advertisers
are already using this information for targeted We should also learn not to trust every mes-
ads, so the potential for exploitation seems sage from contacts in the social networks we
obvious. use, and don't assume that just because a
website is high-profile and has a good reputa-
Another new aspect of these attacks will be tion, it is inherently safe.
automation - with the use of geographical IP
location, automatic language translators that In the end - we should learn and teach. Edu-
are becoming better and better, and informa- cate ourselves and others about potential
tion about personal interests and tastes that threats.
can be found and accessed on the Web.
Zeljka Zorz is a News Editor for Help Net Security and (IN)SECURE Magazine.
Office applications (Adobe Reader, Microsoft Office, etc.) are being actively
targeted by malware authors. Malicious documents “in the wild” that try to in-
fect your machine by exploiting vulnerabilities in the office applications
abound. For more than a year now, PDF files targeting Adobe Reader have
been quite popular with malware authors.
I assume that you need to use vulnerable of- steal confidential documents from a competi-
fice applications on your business computer, tor.
and that applying patches to fix vulnerabilities
is not always possible, or that it requires leav- I had one important criteria for selecting tech-
ing your machines unprotected for a time. I niques to feature in this article: use only free
also assume that using alternative office ap- software.
plications to change the attack surface is not
an option for your business. Least-privileged user account (LUA)
The techniques featured here help to protect Almost all shellcode I see in malicious docu-
you from malware that targets the general ments (PDF, Word, Powerpoint, …) found “in
Internet population. These techniques are not the wild” does the following:
appropriate to protect you from targeted at-
tacks. In a targeted attack, the malware author 1. Download a trojan from the Internet using
has information about his target that allows HTTP
him to design his malware to operate in the 2. Write the downloaded executable to
(restricted) environment of his target. SYSTEM32
3. Execute the downloaded executable.
An example of malware used in a targeted at-
tack is a malicious PDF document designed to
This infection method only works if the user is still prevent high-risk applications (like Adobe
the local admin. If the exploited program has Acrobat and Microsoft Office) from having full
no rights to write to SYSTEM32, the shellcode control over the system by restricting their
will fail in its task and the Trojan will infect the rights. This is achieved by using a restricted
machine. token for the processes of these applications.
To protect your users against this type of at- There are 2 popular tools to launch programs
tack, restrict their user rights. Windows Vista with a restricted token:
and later Windows versions do this for you
with UAC, even if youʼre an administrator. • DropMyRights by Michael Howard
• StripMyRights by Kåre Smith.
On Windows XP, you have to use a normal
user account instead of an admin account to Both tools create a restricted token (by remov-
achieve this. But running with LUA on Win- ing privileges and denying groups that provide
dows XP is not always easy. If you really need local admin rights) and then launch the target
to allow admin rights on Windows XP, you can program with this restricted token.
Itʼs not always easy to launch a program with Windows to always restrict the rights of a spe-
DropMyRights, as there are many ways a pro- cific program, StripMyRights also supports the
gram can be launched on Windows. For ex- “Image File Execution Options” method with
ample, it can be done with a file-type associa- the /D option.
tion or from a browser. To help you configure
The “Image File Execution Options” is de- ify the debugger to use. This can really be any
signed to allow you to launch a program executable. To restrict the rights of Adobe
automatically inside a debugger. In the “Image Reader, add StripMyRights to the
File Execution Options” registry key, you spec- AcroRd32.exe Image Execution path like this:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
File Execution Options\acrord32.exe]
"Debugger"="StripMyRights.exe /D /L N"
This way, each time AcroRd32.exe is exe- use Software Restriction Policies. These can
cuted, StripMyRights executes first, creates a be set locally with the Local Security Settings
restricted token and then launches or in your domain with a group policy.
AcroRd32.exe with this restricted token.
Software Restriction Policies allow you to
Another technique to use restricted tokens force specific applications to run with a
that does not require additional software is to restricted token.
You just have to create a registry value and some malware will load a malicious DLL inside
create a rule for each application you want to the existing process).
restrict.
This is an old idea youʼll find implemented in
Another very effective way to prevent mali- many sandboxes and HIPS. I added a new
cious documents from infecting your PCs is to DLL to my basic process manipulation tool kit
prevent vulnerable applications from starting to prevent applications from creating a new
other applications. As almost all shellcode process. Loading this DLL inside a process
found in malicious documents “in the wild” will will prevent this process from creating a new
ultimately start another process to execute the process. When the DLL is loaded inside a
Trojan, blocking this will prevent the Trojan process, it will patch the Create Process API
from executing (there are exceptions to this - to intercept and block calls to it:
Hook-createprocess.dll is a DLL that patches table of the executable to add the DLL, or use
the process into which it is loaded to prevent it the AppInit_DLLs registry key with my
from creating new processes. It does this by LoadDLLViaAppInit DLL.
patching the Import Address Table of
kernel32.dll for ntdll.dll to hook API functions JavaScript and Adobe Reader
NtCreateProcessEx, NtCreateProcess and
NtCreateUserProcess. There are two specific techniques to protect
Adobe Reader from malicious documents.
Calls to these functions are intercepted and Most malicious PDF files employ JavaScript to
not passed on to the original functions. In- exploit a specific JavaScript-function vulner-
stead, a code is returned indicating that the ability or to perform a heap spray. When you
operation was blocked. The result is that func- disable JavaScript support in Adobe Reader,
tions in kernel32 used to create new proc- the JavaScripts inside PDF documents will not
esses fail (like WinExec) and so the patched be executed when the file is opened. The re-
process canʼt create new processes. sult is that vulnerable JavaScript functions
won't be exploited, or that PDF-exploits will fail
This is all it takes to block most shellcode because the JavaScript heap spray didn't exe-
found in malicious documents. cute.
This simple way of preventing applications Adobe Reader has the option to disable
from launching other applications comes with JavaScript, but it has a drawback. When a
some drawbacks. For example, the Check user opens a PDF document with embedded
Update function in Adobe Reader will not func- JavaScript, Adobe Reader will prompt the user
tion anymore. to re-enable JavaScript for this specific docu-
ment.
To load hook-createprocess.dll inside vulner-
able applications, you can update the import
Your users will need instructions what to do dialog box has been replaced by a less intru-
with this dialog (i.e. click No), unless you use sive message:
the latest version of Adobe Reader where the
A less restrictive JavaScript protection tech- DocMedia.newPlayer, you need to add this
nique is to use the JavaScript BlackList function to registry value tBlackList. By doing
Framework. so, JavaScripts using this function will be in-
terrupted when the vulnerable function is
This new feature allows you to leave support called inside the script.
for JavaScript enabled, but to blacklist vulner-
able JavaScript API functions. The user will see a warning, but he will not
have the option to allow the function call to go
For example, to protect Adobe Reader from through.
the 0-day in JavaScript API function
Conclusion select the PDF category:

blog.didierstevens.com/category/pdf
This article features several techniques to pro-
tect vulnerable office applications from exploi- Keep in mind that these techniques work with
tation by malicious documents. current “in the wild” malware because we miti-
gate the tactics used by malware authors, but
For step-by-step instructions on how to im- that this is an arms race and that evolving tac-
plement these techniques, visit my blog and tics require evolving protection measures.
Didier Stevens (CISSP, GSSP-C, MCSD .NET, MCSE/Security, RHCT) is an IT Security Consultant currently
working at a large Belgian financial corporation. He is employed by Contraste Europe NV, an IT Consulting
Services company (www.contraste.com). You can find open source security tools on his IT security related
blog at blog.DidierStevens.com.
Here are some of the Twitter feeds we follow closely and can recommend to anyone interested in
learning more about security, as well as engaging in interesting conversations on the subject.
If you want to suggest an account to be added to this list, send a message to @helpnetsecurity
on Twitter.
Our favorites for this issue are:
@IBMFedCyber
Chris Ensey - Principal Security Strategist for IBM Federal.
http://twitter.com/IBMFedCyber
@wikidsystems
Nick Owen - CEO of WiKID Systems.
http://twitter.com/wikidsystems
@paperghost
Chris Boyd - Internet security guy.
http://twitter.com/paperghost
@mikkohypponen
Mikko H. Hypponen - CRO at F-Secure.
http://twitter.com/mikkohypponen
While I'm of the opinion that the economy is done bleeding for the most part,
it does not mean that I believe weʼll be back to the glory days anytime soon.
That produces a big challenge in 2010 for CIOs, who are trying to piece to-
gether a series of legacy, new and specialized network systems to optimize
data and productivity without sacrificing their security posture in the process.
While easier said than done, it is by no means that particular piece of software or equipment
impossible. What's more, CIOs are not alone, without much regard to their relevance to to-
and there are plenty of best practices to do day's environment or impact to other net-
this. That's because the issue is not new, de- works. In fact, many policies over time can be
spite the negative impacts to an organization's so conflicting as to make them practically use-
competitiveness, manpower requirements and less.
operational risks. The upfront capital and per-
sonnel costs to upgrade systems become dif- This is why CIOs need to take the time to
ficult to justify. So while the goal of implement- conduct a thorough review of their policies for
ing new, integrated platforms is still on the such issues. The best way to do this is to first
wish list of many IT departments, here's how determine what their overall goals and objec-
companies can deal in reality, and systemati- tives are in preserving and protecting their or-
cally ensure that all its systems are working ganizationʼs precious data. As daunting as that
together in the most secure and efficient man- sounds, there is help at little to no cost. For
ner possible. example, the well renowned SANS (SysAd-
min, Audit, Network, Security) Institute offers a
Review goals before setting policies Security Policy Resource page on its Web site
(www.sans.org/security-resources/policies/).
Security policies are usually modified and up- The free program is a consensus research
dated when an organization implements a new project of the SANS community, and is de-
system, setting certain rules and guidelines for signed to offer small to medium-sized
organizations the tools they need to rapidly are encouraged to share their own policies if
develop and implement information security they reflect a different need than the program
policies. The vast set of resources includes provides, thereby expanding the benefits of
templates for 24 important requirements. The the resource center.
site also offers those new to policy develop-
ment a way to get a head start on such initia- Only after a general goals framework is estab-
tives, while also providing specific direction on lished can CIOs and their security teams audit
issues related to legal requirements, such as their systems for conformity, and determine
the HIPAA guidelines. what changes are needed. Often times or-
ganizations will conduct one before reviewing
In exchange for leveraging these tools, SANS their security policies, in typical “cart-before-
asks that organizations actively take part in the-horse” fashion. Though the largest ex-
updating and improving the templates, as it pense at this point is time, the hard dollar sav-
aims to consider the resource page a contin- ings that come from be starting with a review
ual work in-progress. In particular, companies of policies is significant.
Most CIOs donʼt have a full accounting of all the equipment

and intangibles they own and operate.
Perform a security audit cause theyʼve got a specific tasks or is the

oldest device in the department doesnʼt mean
The natural tendency is to believe that the that itʼs not tied to a mission critical business
only way to conduct one effectively is to hire task.
an outside consulting team and break the
bank in the process. That need not be the • List known threats. Brainstorm how each
case. It does, however, require full commit- system and device are inherently threatened
ment from IT staff and the creation of a sys- from internal and external sources. These will
tematic process to make this happen in the include things such as how complex employee
most efficient manner possible. At a minimum, passwords are as well as how many folks
include these steps: have access to sensitive or private company
data, the presence and configuration of spam
• Know what you should know. Begin by filters, anti-virus program and such. Keep in
identifying all the assets within the IT depart- mind, too, that certain features and functions
ment, categorizing them by system and pur- embedded in newer systems are not in some
pose. As strange as this may sound, most of the legacy ones. Threats of old may still
CIOs donʼt have a full accounting of all the need to be identified and respected.
equipment and intangibles they own and op-
erate. The biggest reasons for this is because • Look at trends. Keeping up to date on the
some devices, software, files and other sys- latest IT publications to read about the past
tems are shared with other departments. As a and potential future security trends gives a
general audit rule, stay within the realm of as- good foundation for determining the “un-
sets that are owned by the IT department or known” and then figuring out the steps neces-
required to effective maintain the companyʼs sary to counter that threat. Other good re-
network security. sources include industry associations and
peers.
• Prioritize the assets. After a thorough list is
compiled, the next step is to figure out which There are also free, detailed checklists avail-
ones pose the biggest risk. This can be based able for download from a host of credible
on a factor of the probability of being attacked sources, including:
and the level of harm that can come of it. One
word of caution – donʼt simply ignore the leg- • Help Net Security - bit.ly/8wsQc7
acy systems when making the list. Just be- • University of Massachusetts - bit.ly/8h7KKe
Another good idea in conducting an audit is to Going a step further, organizations can make
assign different personnel who are not nor- it an even greater habit to incorporate such
mally in charge of asset management or secu- subject matter expertise in order to solidify the
rity procedures to participate. Their fresh set of right processes and procedures in three im-
eyes can provide a good “sanity check” to ex- portant ways:
isting documentation and processes. It can
also provide a foundation for good cross- • Build an internal advisory team. While se-
training within the department that may come curity folks are the natural choice to lead such
in handy later. For anyone whoʼs been a victim efforts, they will by no means be the only ones
of “Murphyʼs Law” knows that security in- involved. The ideal situation would be for all
stances, like any crisis, usually occurs when departments to have a designated representa-
the main person is on vacation or out of the tive coordinate efforts within and outside their
office and unreachable. area. Herein lies the challenge for any com-
pany – policies and practices will often tran-
Turn policies into practices scend areas of responsibilities for individuals
and managers, and failure to make security
With a clear understanding of assets, priorities practices seamless across these lines will
and threats in place, the next thing to do is create vulnerabilities that hackers seek to ex-
find out where the existing holes lie and shore ploit.
up defenses. The key is to convert the overall
goals, system set ups and policies into consis- • Leverage the lessons learned from oth-
tent use practices. That means organizations ers. None of us are alone in our quest to exe-
will need to look at developing an effective se- cute strategic security initiatives with finite re-
curity intrusion response plan that will docu- sources, many real-life examples of such are
ment and provide the appropriate steps to re- well documented in trade magazines, journals,
act for each intrusion as it occurs, be it hard- webinars and other free resources. Pay closer
ware or software oriented. As important, how- attention to them – particularly those using
ever, is the need to establish network access similar legacy systems – in order to prevent
controls, or the verification the security of any getting the same scars as others have done
user into the system against an accurate and before.
up-to-date list, as well as content- and rate-
based intrusion prevention platforms to • Pressure vendors to produce. Organiza-
counter hackers. tions should not go at it alone, but rather enlist
their system integrators and product vendors
Doing this may not only require purchasing to help make this happen. The best partners
additional VPN firewalls, email gateways and are the ones who should have robust, turnkey
Unified Threat Management appliances, but offerings that specifically and clearly meet this
also training and educating employees on the demand. These firms should also maintain an
impact their systems have on others, particu- arsenal of best practices to show a true return
larly legacy systems that are not their own. on a companyʼs investment.
The introduction and sophistication of middle-
ware has made this occurrence extremely Time and people – The biggest investment
commonplace. In these cases, manuals and
trade journals are a good start, but the best The practices reveal the most important ele-
resource may be the IT staff members who ments to successfully implementing a security
have kept the legacy equipment operational program that protects new and legacy sys-
well past its projected lifespan. tems; the time and people required to make it
happen. While most likely the biggest line item
These folks know the ins and outs of the sys- in an IT Departmentʼs budget, funding it ade-
tem and all of its benefits and shortcomings. quately is a valuable investment in preserving
Sharing that knowledge across employees productivity, data and – ultimately – and or-
might be the best preventative measure a ganizationʼs business goals. Talk is cheap and
company can implement. policies are only as good as those who are in
charge of its execution.
This is not unlike other business operation, ing sensitive and confidential corporate data,
such as offshore software development or such systems should not be procured and in-
outsourced product fulfillment, where long- stalled at the expense of getting the right per-
standing benefits of such initiatives are not re- son with the right equipment in place to moni-
alized without oversight and monitoring tor and respond to evolving issues in accor-
authority. dance with a well established corporate IT pol-
icy.
As such, budget debates must focus not just
on what legacy systems to keep and what kind Companies that successfully thwart a cyber
of security equipment to implement, but also attack will possess a well integrated combina-
on the individuals and resources needed to tion of the right tools with the right decision
set overarching policies and management makers. No single algorithm or detection sys-
procedures; the absence of which will mean tem will be enough, if staff members are not
that all the money spent keeping up with the provided the training and tools to do their job.
latest tools and systems will be fruitless. Make no mistake – people have and always
will matter if organizations are to maintain a
While security tools will also be essential to robust security posture.
keep networks running optimally while protect-
Max Huang is the Founder and President of O2Security (www.o2security.com), a manufacturer of high-
performance network security appliances for small- to medium-businesses as well as remote/branch offices,
large enterprises and service providers. Max can be reached at max.huang@o2security.com.
Accurate assimilation of the differences amongst cryptographic systems of-
ten evades even the most experienced IT professional. The objective of this
article is to offer the means for understanding this topic and aid the security
engineer in making decisions.
Back in the summer of 2002, I had designed a advantages of AES over 3DES were worth the
four-layer firewall system for an international additional cost.
bond firm. During the process, one of the ac-
tion items was to select an operating system We include DES in this discussion, even
image for the firewalls in question. The manu- though it is currently considered to be an in-
facturer of the firewall(s) is not important, al- adequate encryption algorithm. Understand-
though it should be noted that it was (and is) ing DES directly leads into the comprehension
one of the market leaders. of what is happening when a 3DES process is
being used. Having said that, what prompted
One of the variables in selecting the image for the creation of this article was the fact that the
the firewalls was encryption. The viable op- internal IT staff at the firm in question had a
tions available were DES (Data Encryption surprisingly limited understanding of what
Standard), 3DES (Triple DES), and AES (Ad- they were actually buying. Yet, what was sur-
vanced Encryption Standard). The dilemma prising was how adamant they were at insist-
that existed at the time was that DES and ing they must have the newer algorithm. It is
3DES could be bundled into the firewalls for this lack of understanding we wish to help the
free. AES, on the other hand, required a fairly IT community with here, since we find more
significant additional outlay of capital. The and more IT folk (especially the more experi-
question, of course, was whether or not the enced professionals) that toss around
acronyms without researching their underpin- selves. Once shown to have vulnerabilities,
nings. Since all IT decisions come down to the algorithms tend to get stronger via im-
dollars and sense versus functionality, this proved cryptographic mathematics (usually).
scenario turned into a “risk analysis” exercise
centered on how likely it was that a hypotheti- Please keep in mind that this “cat and mouse”
cal attacker had the means to “crack” 3DES game between code creators and code
and yet not be capable of getting through breakers is not new, by ANY means. Cryptog-
AES. Then, comparing that difference in raphy was very popular even during the time
probability to the implied “loss” that would be of Julius Caesar since the security of a mes-
realized in the event of a breach, in an effort sage delivered by a human could NOT be se-
to justify the additional cost. cured simply by trusting the human. In fact,
recall the Hundred Years War between France
The result of this exercise was that 3DES was and England. At that time, the cryptanalysts
more than sufficient since we had calculated it were ahead of the cryptographers. France be-
was more likely (from a probabilistic stand- lieved the Vigenère cipher to be unbreakable.
point) that the equipment would be stolen, The British, of course, cracked that code. No
physical security compromised, and the in- algorithm is truly unbreakable. Hence, the se-
formation easily removed from the internal curity of entire nations sometimes rests on the
systems without needing to crack one encryp- strength of encryption codes! But, let us return
tion key. This result was disliked greatly by the from our digression.
IT staff, but liked immensely by the accounting
department who now felt they saved quite a Put simply, a “cipher” is an algorithm for per-
bit of money. forming encryption and decryption. With a
substitution cipher, one letter is substituted for
Since this will not be an overview on how to another to encrypt a message. In simplest
develop risk scenario calculations, weʼll focus form, the number of letters in the output
on trying to educate our fellow IT profession- equals that of the input. One of the shortcom-
als on why BOTH algorithms are great, but if ings of this simple cipher is its vulnerability to
one costs more money, either can be used so frequency analysis.
one can save money. In the process, we will
hopefully clear up some misunderstandings If a message has 15 B's, for example, and B
about their inherent differences and advan- is replaced by L, the ciphertext would still con-
tages in different situations. tain 15 Ls. As the message lengthens, it be-
comes more and more vulnerable to fre-
In an effort to bridge the gap between the quency analysis because the message would
“newbie” IT professional and the seasoned retain the frequency patters found in the lan-
expert, we will offer some definitions where guage, even though the characters are differ-
appropriate. Our goal is simply this – to come ent.
away with a better understanding of the differ-
ences amongst encryption algorithms and Polyalphabetic ciphers were invented to make
where they fit in todayʼs business computing up for the shortcomings of the substitution ci-
environment. pher. The Vigenère cipher is an example. It
encrypts using a series of different Caesar ci-
Data Encryption Standard, 3DES, and phers based on the letters of a keyword. This
Advanced Encryption Standard makes it invulnerable to frequency analysis.
To begin, let us quickly come up to speed on National security dictated the need to create
some points: “Cryptology” is essentially de- DES, which was adopted by the National In-
fined as the making and breaking of secret stitute of Standards and Technology in 1977,
codes. It consists of two parts: cryptography, and later approved by the American National
which is the development and use of codes; Standards Institute in 1981 (ANSI X3.92). It is
and, cryptanalysis, which is the breaking of defined as a “Block Cipher” because it han-
the codes. These two aspects go hand in dles data in 64 bit “blocks.” This means eight
hand as the cryptanalysis confirms (or ne- bytes, since one byte [historically] equals
gates) the strength of the algorithms them- eight bits. Within this 64-bit block, 56 bits are
used for the “key” to encrypt and decrypt data. member, EVERYTHING in IT is eventually
Please do not let the terms “key,” “cipher” and guided by cost. So then, the question be-
“ciphertext” impede your understanding of en- comes, is 168 bits adequate to protect even
cryption technology (we can do that with the most sensitive of data?
much more complex scenarios!). Just re-
member that TEXT follows a CIPHER (algo- It only took 21 years for DES to be cracked
rithm) using a KEY, creating CIPHERTEXT. using a brute force attack. In 1998, The Elec-
Thatʼs it. For example, letʼs encrypt a phone tronic Frontier Foundation utilized $250,000 of
number: (212)-755-2477. To encrypt this text computing power to crack DES in less than
we will use an algorithm whereby we very three days. Since then, many successful at-
simply add a key to each digit. Thus, the algo- tempts have been made in cracking DES. The
rithm is “digit+key” = “ciphertext.” The key we point weʼre getting at is this: whether itʼs a
will use is arbitrary – letʼs say the number 5. single computer or many computers operating
Therefore, the ciphertext is (767)-200-7922. in parallel, the dollar value per computer cycle
will vary; however, it is the number of keys
Notice that if the digit is greater than 10, we that can be processed per second that mat-
simply drop the “tens” place. This should be ters. The computer in 1998 processed 88 bil-
reflected in the definition of our algorithm BUT lion keys per second. If we assume a 10-fold
in an attempt to keep this simple we opted for increase in computing power in ten years,
understanding instead. In conclusion, to de- then today, it would still take many hours to
crypt our ciphertext, the recipient must be crack DES. NOW, given that, in comparison,
given our encryption algorithm and key. The using the same computer, with the 10-fold in-
process can then be done in reverse - 7-5=2, crease, it would take approximately 3 quadril-
6-5=1, etc. Of course, even DES, with its anti- lion years to crack 3DES. Thatʼs about
quated 56-bit key, is MUCH MORE compli- 250,000 times the age of the universe. Thus
cated than this example; but, hopefully, some the odds, under current conditions, of crack-
insight has been offered that will aid the un- ing 3DES are pretty slim.
derstanding of where we are going with these
ideas. For basic understanding, 3DES uses a meth-
odology known as “EDE” - encrypt, decrypt,
DES, with a key that is 56-bits long, provides encrypt. This means three different keys are
approximately seventy-two quadrillion itera- used → [k1,k2,k3]. IF we simply encrypt 3x,
tions. Thatʼs 72 followed by 15 zeros. Al- using k1,k2, and k3, the effective key length
though this may seem like an incredible would be only 58 bits, instead of the 168 with
number, as computing power continued to 3DES-EDE.
increase after 1977, the possibility of a com-
puter with enough power to traverse all com- Now that we know all this, why should you
binations being used also increased. It be- ever want to introduce another algorithm? The
came clear that eventually, this would not short answer is - it depends. Letʼs consider
suffice for all applications, especially those where AES (or the need for an alternative to
where a breach would have grave repercus- 3DES) became a consideration.
sions.
The National Institute of Standards and Tech-
The DES algorithm and the mathematics of nology completed a task to find a replacement
performing the DES operation more than once for Triple-DES. This endeavor was undertaken
are linear. That means that if it takes x micro- because of several factors. Obviously, as
seconds to encode a block using DES, with a computer power continues to increase, the
56-bit key, it would take 3 times x to encode time it takes for a brute force attack against
the same data by performing the DES algo- an algorithm to be successful would drop. De-
rithm with three distinct keys. Doing so pro- spite the times described above, which illus-
vides an equivalent key of 56 x 3 or 168 bits. trate the improbability of this, another factor
Not bad! However, we explain this process in that could make a difference is computational
this manner to clearly show that going from complexity. What does this mean? In ex-
DES to 3DES requires three times the com- tremely simple terms, the algorithm cannot
puting power to encode the same data. Re- have any shortcuts that circumvent the
process of calculation the answer. In other breakable cipher must have keys which are at
words, if we multiply 3,412 and 7,815, we least as long as the plaintext, and used only
need to follow a step by step mathematical once. Of course, this is completely impractical
process to get the answer; first, five times in some cases and thus, the Advanced En-
two, etc. However, if we multiply 1,000 and cryption Standard addresses many of the
10,000, we can simply count the zeros and needs that today, would render an algorithm
put a one in front; 10,000,000. This is a short- obsolete or unusable.
cut in the algorithm used to multiply the num-
bers. In evaluating the usefulness of an en- Now that we have established why AES is
cryption algorithm, there can be no possibility generally a better choice for encrypting infor-
that any of these shortcuts exist. mation than 3DES, we would like to provide
some education about what AES is - in a way
It was also decided that the replacement for that is easily “digestible”. It is widely known
3DES would need to be more “computation- that AES is currently based on a cipher
ally efficient” than 3DES. What this means, in named “Rijndael.” The name is derived from
simple terms, is that the number of compute two Belgian cryptographers, Joan Daemon
cycles required to perform the encryption and Vincent Rijmen.
would be less than the number required to
compute 3DES ciphertext of the same The AES Algorithm works via a scheme called
strength. The reason for this is that we now “substitution-permutation” network. Very sim-
have a plethora of handheld devices and ply, the scheme takes BOTH the original in-
gadgets that help us communicate. These de- formation to be encoded, plus a key and uses
vices need encryption, but they are using this input. Based on this input, a substitution
processors that may not be as powerful as overlay changes the information. Each over-
those found in a desktop computer. Hence, an lay is a “round”, so depending on how many
encryption algorithm that requires less times this is done, we say the original infor-
“horsepower” would become more and more mation went through an x number of rounds to
essential. get the ciphertext. If you are interested, you
can look up the actual algorithm as it is open
The result was that the Advanced Encryption to the public. From a purely mathematical
Standard is more computationally efficient sense, it is a very elegant method AND is very
and stronger, when key lengths are the same fast at producing ciphertext. Again, it is this
as with 3DES. AES works fast even on small focus on speed that led to Rijndael becoming
devices such as smart phones, smart cards the algorithm of choice. Please be advised
etc. AES provides more security due to larger that THERE ARE OTHER ALGORITHMS that
block size and longer keys. It uses 128 bit are mathematically more difficult to crack.
fixed block size and works with 128, 192 and However, they lack some of the other bene-
256 bit keys. The Rijndael algorithm is in gen- fits, such as speed. Remember, an increase
eral flexible enough to work with key and in speed AND encryption strength is known as
block size of any multiple of 32 bit with mini- “computational efficiency.”
mum of 128 bits and maximum of 256 bits.
Conclusion
Without question, there is constant scrutiny
over how much time is needed to crack an There are a few things to consider when dis-
algorithm. Hundred of mathematical analyses cussing AES and 3DES that should not be
can be called upon. However, numbers that omitted. First of all, these are “symmetric” al-
are mentioned in security circles center on gorithms because the use a private key for
approximately 5 billion years to crack Triple- BOTH encryption and decryption. For com-
DES and 150 trillion for AES. This, of course, parison, RSA is an asymmetric cipher.
is implying the same information to encrypt,
the same key size, and computational power. We bring this up to illustrate one point. Key
length does NOT indicate the overall strength
Is it possible to use a cipher that is completely of the algorithm. RSA, for example, with a key
unbreakable? Claude Shannon proved, using length of 2048 bits is equivalent in strength to
information theory, that any theoretically un- an RC4 cipher with only 128 bits to its key!
Asymmetric algorithms like RSA, elliptical- I would like to close with an illustration of ex-
curve and Diffie-Hellman can be 1000x slower pectations for future key lengths, predicted by
than symmetric algorithms. Factoring large the NIST. The table below is public informa-
numbers or computing logarithms are the ba- tion and can be found by starting at nist.gov
sis for the asymmetric algorithms and this and navigating through the site.
take significantly more time. VPNs use
asymmetric encryption to hide the exchange These predictions assume algorithms will re-
of the symmetric keys that will be used to en- main mathematically and cryptographically
crypt the data. This is done because encrypt- sound. Further, that computing power will con-
ing data in real time requires a fast algorithm. tinue at its current rate of growth; thus brute
Asymmetric encryption is simply too slow. force attacks continue to get faster. Note that
Hence, each of these ciphers has its place in if a method other than brute force is discov-
the information technology world. ered, key lengths become obsolete.
Protection for this Symmetric key Asymmetric key Digital signature Hash
number of years.
3 Years 80 1248 160 160
10 Years 96 1776 192 192
20 Years 112 2432 224 224
30 Years 128 3248 256 256
Quantum computing 256 15424 512 512
Please also consider an interesting point cles” than 3DES and some other popular al-
about 3DES usage in practice: 3DES uses a gorithms not described in this article.
scheme known as “EDE” (Pronounced Eddie) • Key length does NOT indicate overall
- encrypt, decrypt, encrypt [using keys strength, although lengthening the key does
k1,k2,k3]. If, instead, we simply encrypted 3x make the algorithm stronger BUT at a cost in
(thinking that by encrypting three times we computational power.
were increasing security), using k1,k2, and k3
as keys, the effective key length would be 58 Each encryption algorithm can exist in soft-
bits, instead of the 168 with 3DES-EDE. ware OR hardware and the one chosen
should fit the application and take CPU power
In summary, a few key points that the reader and required speed into account.
should keep in mind:
Hopefully, this discussion has helped you un-
• 3DES is secure enough for just about every derstand some of the differences in 3DES and
corporate application and should NOT be AES, and has perhaps enhanced what you
viewed as inferior to newer algorithms. may have already known about encryption.
" o The application of DES 3x with differ-
ent keys makes brute force attacks on 3DES If you would like to explore this further, I would
infeasible because the basic algorithm has highly recommend the following two titles:
withstood the test of time for 35 years.
• The AES algorithm is a faster cipher, able to 1. Introduction to Algorithms, by Ron Rivest.
provide equivalent security with less CPU “cy- 2. Introduction to Modern Cryptography, by
Jonathan Katz
Anthony Fama is a partner at Computer Integrated Services. He has held numerous industry certifications,
including some from Novell, Cisco, and Sun. He holds a Bachelor of Science Degree in Electrical Engineering
and Physics and is an MBA as well. He also has a Masters Degree in Astrophysics and has been a member of
Mensa for over twenty years.
In any environment, large or small, the managing and interpreting of log files
is a time consuming and expensive responsibility. Generally, this particular
job is perceived as a boring waste of time, and is usually pushed onto whom-
ever is the “weakest” part of the team and executed half-heartedly and - there-
fore - poorly.
I, for one, believe that log files contain a lot of The great majority of these devices will be
wisdom that most systems, applications and spitting out messages with a vengeance, and
network administrators miss. While log files it is you who must prioritize and process these
are considered a necessary evil and are con- events. Even if you think itʼs not necessary,
sulted only when someone is complaining you will probably have to do it as a compli-
about problems with certain services, they are ance requirement.
key to understanding the baseline behavior of
your environment (when everything is running All of this would be a big problem if you had to
smoothly) and are therefore fundamental for do it step-by-step, page-by page, by yourself.
the detection of anomalies. “Love thy logs like Luckily, there are plenty of products out there
you love thyself” should be a mantra for all today that can provide these two services. I
previously mentioned administrators. am, of course, talking about log management,
and security incident and event management
Even in the smallest of environments you'll solutions. The former acts as a black hole into
have a dozen computers (workstations and which all log events within your network are
servers) and a few network appliances (rout- siphoned and kept in. The latterʼs task is to
ers, firewalls, switches, access points). Add correlate events you throw in it and provide
some multifunctional printers into the mix, and you with a Web 2.0 dashboard from which you
you're good to go. can analyze the results.
How can you learn about your environment Interpret any log, on/from any system
and how to protect it in a cost-effective man-
ner, enable your organization to respond to OSSECʼs current version is 2.3 and the client
incidents when they happen, and satisfy audi- runs on Windows, Linux, AIX, Solaris and HP/
tors? In my opinion, OSSEC is a good answer UX. The server runs on Linux, AIX, Solaris
to that question. and HP/UX. Additionally, OSSEC can even
monitor systems on which you cannot install
I found out about OSSEC while I was search- the software for whichever reason.
ing the web for log management advice. Back
in those days, we had to do a lot of things by The built-in rule base is pretty impressive.
ourselves. Apparently Daniel Cid had been Alongside log rules for open source solutions
encountering the same problems I was, be- like Apache, MySQL, sendmail and squid,
cause he decided to do something about it. there is also an impressive amount of rules for
He developed OSSEC, and released it as commercial solutions such as several AV en-
open source - which it still is today. gines, firewalls, networking products and MS
Exchange.
You may notice that the rules are defined in several daemons, all assigned limited and
.xml files. It is incredibly easy to create your specific tasks. All but one are running on
own rules or modify existing rules to fit your chroot. Letʼs introduce them:
requirements. As long as you are somewhat
familiar with regular expressions - for xml and Analysisd runs on chroot as the user ossec
the application youʼre creating rules for - there and does all the analysis. In a standalone in-
is basically no limit to what you can do with stallation this process obviously runs on the
OSSEC. client, but in the client/server setup it runs
only on the server. The direct benefit is that
The OSSEC architecture the resource-intensive analysis of events is
executed by the server, which is usually dedi-
In this article, I'm assuming a client/server in- cated to doing just that. This leaves the re-
stallation, since all but one daemon are pre- sources craved by your application un-
sent in both the client/server and the standa- touched.
lone installation. OSSEC is designed to run
Remoted (running on the server) receives the them to the server (agentd and remoted), de-
logs from Agentd (running on the client). Re- code and analyze them (analysisd) and we
moted is running on chroot (user = ossecr) act upon the generated alerts (maild and
and Agentd too (user = ossec). Remoted is execd) if so required.
responsible for all communications with the
agents. Analysis: when gibberish becomes
language
Monitord is responsible for monitoring the
agents and takes care of the centralized log- A log event can contain a lot of information,
files. The daily logs are compressed and but we donʼt need all of it. We are interested
signed by this process, too. We have one in the parts that we can use to create action-
process doing analysis, one sending events able alerts. OSSEC does the analysis in three
and another receiving them. But, we also phases: pre-decoding, decoding and analysis.
need a worker to collect the events, and this
task is performed by the logcollector. This In the first phase - pre-decoding - the informa-
daemon is running as root, which is required tion provided by the event source is parsed
because it obviously needs access to the log- and known fields are extracted. The time, the
files it will monitor. system name and the application name are of
particular interest here, but the log message
The last two daemons are maild and execd. is left untouched and passes on to the next
Maild, running on chroot (user = ossecm) phase, decoding. Here, the log message is
sends mails on specific alerts if e-mail notifi- inspected in depth and information is further
cation is enabled (weʼll see later that this is extracted. Usually we want to gather informa-
easily configurable). The final process, which tion like source IP, username, destination IP,
coincidentally converts the HIDS into a HIPS, etc.
is execd - the process responsible for starting
active responses. With a basic understanding of regular expres-
sions you can create your own decoders.
This sums up all the functionality offered by Letʼs take a look at the default PAM decoder.
OSSEC: we collect logs (logcollector), send The first two decoder rules are:
<decoder name="pam">
<program_name>(pam_unix)$</program_name>
</decoder>
<decoder name="pam">
<program_name></program_name>
<prematch>^pam_unix|^$pam_unix$</prematch>
</decoder>
The first one tells OSSEC to treat any log other program name. Those messages that
message for which the program name is contain either the string pam_unix or (pam_u-
(pam_unix) as a PAM message, applying nix) are still regarded as PAM messages.
subsequent decoder rules to it. The second Now, we need to extract information we can
rule is to catch those PAM messages that, for work with from those messages.
one reason or the other, get logged with an-
<decoder name="pam-user">
<parent>pam</parent>
<prematch>^session \w+ </prematch>
<regex offset="after_prematch">^for user (\S+)</regex>
<order>user</order>
</decoder>
The first tag of interest is the <parent> - this (in this case the username). We do that by
refers to the earlier decoder rules. Any mes- using a regular expression, hence the <re-
sage that is decoded as PAM is picked up this gex> tag that we tell to start after the pre-
rule. match. Any information we need from the pat-
tern we put between round brackets. With the
The <prematch> tag looks for a string that <order> tag, we tell OSSEC in which order we
starts with the word “session”, followed by one find our information. That will become clearer
or more other words. If these prerequisites in a message from which we extract - more
are met, weʼre ready to grab some information information.
<decoder name="pam-host-user">
<parent>pam</parent>
<prematch>rhost=\S+\s+user=\S+</prematch>
<regex>rhost=(\S+)\s+user=(\S+)</regex>
<order>srcip, user</order>
</decoder>
This is where things become interesting. No- name and we tell OSSEC that the first string
tice that the <regex> tag doesnʼt contain the we captured in round brackets is that IP ad-
prematch parameter because we want to ex- dress and the second one is the username.
tract information from the same string that we Hereafter, everything builds upon the decod-
use to match on. From this message we want ers. Letʼs have a look at the PAM rules.
to extract the source IP address and the user-
<rule id="5500" level="0" noalert="1">

<decoded_as>pam</decoded_as>
<description>Grouping of the pam_unix rules.</description>
</rule>
Every rule gets a unique id, a number be- quired. In the <decoded_as> tag we tell OS-
tween 100 and 99999. The level can be any SEC that this rule applies to all messaged de-
number between 0 and 14 - it allows you to coded as PAM by our decoder rules and with
granularly rank alerts by severity. Level 0 <description> we tell everyone who has never
means that this event is of no significance as seen an OSSEC rule before what this is
we use it only to group the pam_unix alerts. about.
With noalert we specify that no alerts are re-
<rule id="5501" level="3">

<if_sid>5500</if_sid>
<match>session opened for user </match>
<description>Login session opened.</description>
<group>authentication_success,</group>
</rule>
Now it gets really exciting! Rule 5501 is a gets logged and with which alert level. A good
level 3 event and builds on rule 5500. We look example would be the following: We want to
for the string “session opened for user” to reg- be alerted when Chris logs on to the alpha
ister a successful login event. OSSEC allows server at any time, but not if any other users
us to build so-called rule trees - chains of log on. It would look a little like this:
alerts that allow us exact control about what
<rule id=”10000” level=”0”>
<hostname>alpha</hostname>
<description>group alpha events</description>
</rule>
<rule id=”10001” level=”10”>
<if_sid>10000</if_sid>
<user>Chris</user>
<description>Chris is logging on to the alpha server</description>
</rule>
Rule trees can become pretty complex, espe- The first thing youʼll need to do to set up ac-
cially when you start weaving in active re- tive response is identify the rules for which
sponses. you want to take action to prevent further
damage. You have to chose wisely, or even
Active response: Defend! write more in-depth rules to make sure you
get as low a false positive rate as possible.
This is where you can get creative. How do
you want to repel attackers today? A good ex- Then, you write your script. What you do and
ample of what you might do here is in the user how you do it is completely up to you - there
quotes on the OSSEC website where Paul is absolutely no limit as to what you can do
Sebastian Ziegler tells about his little experi- here.
ment with the solution at the Defcon15 “0wn
The Box” competition. The next step is enabling the scripts. Copy
them to the active-response/bin folder of your
He let OSSEC fire up arp poisoning against OSSEC install path and reference them in
attackers using the scapy tool. All that was your ossec.conf file. OSSEC comes with
necessary is a set of rules to identify the at- some basic active response scripts – here is
tack and a couple of entries in ossec.conf to an example:
link his script with the rules he wrote. It was
named the most evil entry in the competition.
<command>
<name>host-deny</name>
<executable>host-deny.sh</executable>
<expect>srcip</expect>
<timeout_allowed>yes</timeout_allowed>
</command>
All active response commands start with the and we can tell the system to block a certain
<command> tag and are given a proper name host for x minutes. After that period the re-
with the <name> tag. The <executable> tag verse command will be run, unblocking the
tells OSSEC where the script is and the <ex- host.
pect> tag describes which information is
needed to run this script. The last <time- Now, we are ready to use this command in
out_allowed> tag specifies whether this com- active response scenarios, either based on
mand supports timeout. In this case it can, the rule id or on the severity of the event:
<active-response>
<command>host-deny</command>
<location>local</location>
<rules_id>10013</rules_id>
<timeout>300</timeout>
</active-response>
<active-response>
<command>host-deny</command>
<location>local</location>
<level>10</level>
<timeout>300</timeout>
</active-response>
Both rules will execute the host-deny script. If you want to look into it further, I would sug-
The first one when rule number 10013 is trig- gest starting at the OSSEC website
gered and the second one when any event (www.ossec.net). Additionally, the “OSSEC
with a severity level of 10 or higher is trig- Host-based intrusion detection” book written
gered. by Daniel Cid, Andrew Hay and Rory Bray
and published by Syngress is a very good
Conclusion reference for the solution. If you really get
stuck, you can get a very fast answer from the
I hope that I have given you a good overview OSSEC user group.
of OSSECʼs capabilities. With the support for
multiple operating systems and the flexibility Now off you go! Start loving your log files and
to adapt it to specific environments, I would give them the attention they deserve.
recommend it to anyone looking to gain con-
trol over their environment.
Wim Remes is an information security consultant from Belgium and co-host of the Eurotrash information
security podcast (www.eurotrashsecurity.eu).
RSA Conference 2010 (www.bit.ly/rsac2010)
Moscone Center, San Francisco. 1-5 March 2010.
InfoSec World Conference & Expo 2010 (www.misti.com/infosecworld)

Disney's Coronado Springs Resort, Orlando, FL. 19-21 April 2010.
Infosecurity Europe 2010 (www.infosec.co.uk)

Earls Court, London. 27-29 April 2010.
Gartner Identity & Access Management Summit (europe.gartner.com/iam)

Lancaster London, London, UK. 3-4 March 2010.
Corporate Fraud: Prevention, Detection & Investigation in the Aftermath of

the Global Economic Downturn (www.bit.ly/b4U0RV)
Boston, MA. 15-16 March 2010.
SecureCloud 2010 (cloudsecurityalliance.org/sc2010.html)

Majestic Hotel and Spa, Barcelona, Spain. 16-17 March 2010.
Atlanta SecureWorld Expo 2010 (secureworldexpo.com/events/index.php?id=266)

Cobb Galleria Centre, Atlanta, GA. 27-28 April 2010.
Cyber Defence 2010 (smi-online.co.uk/2010cyber17.asp)

Swissôtel, Tallinn, Estonia. 17-18 May 2010.
ISSD 2010 (issdconference.com)

Westminster Conference Centre, London. 20-21 May 2010.
Authors: Nitesh Dhanjani, Billy Rios and Brett Hardin I Pages: 296 I Publisher: OʼReilly I
We have all been witnessing new kinds of at- measures, and demonstrating the business
tacks emerging thanks to new technologies risk of security exposures.
and ways of using our computers and net-
works. The use of social media, an increas- Brett Hardin is a Security Research Lead with
ingly mobile workforce, cloud computing - McAfee. Before that, he was a penetration
these are just a few of the latest trends that tester for Ernst and Young's Advanced Secu-
increase the possibility of being breached. rity Center assessing web application and in-
This book explains them all and gives you in- tranet security for Fortune 500 companies.
sight into the techniques and mindset of to-
day's attackers. Inside the book
About the authors If there is one adjective that fits all successful
cyber attackers, it's "resourceful". They dig up
Nitesh Dhanjani is a well known information information through any means they can find
security researcher and speaker. He is the and use it effectively to reach their goal.
author of many books about hacking and Whether the reason behind the attack is
computer security, and is Senior Manager in vengeance, fame, political or plain, old fashion
the Advisory practice At Ernst and Young. greed, they always seem to be one step
ahead of the defenders.
Billy Rios is a security engineer and used to
be a penetration tester for both VeriSign and But, that is not exactly true - for every attack
Ernst and Young. He made his living by out- that succeeds, there are hundreds or thou-
smarting security teams, bypassing security sands that fail.
And most of the time, they fail because they There are all these helpful and wonderful tools
have come up against people who have and technologies out there, and we use them
knowledge about which attack vectors are every day to work and play and run errands.
likely to be deployed against a network and This book gives us an insight into all the bad
then securing it against them. things that can happen - so that we can make
sure they don't.
This book covers a lot of ground. It starts with
enlightening us about the myriad of ways an Final thoughts
attacker can gather information needed to
execute the attack: dumpster giving, social Hacking: The Next Generation is an extremely
engineering, scouring the social networks for thorough, enjoyable and easy read. The
information, etc. authors aimed the book at anyone interested
in learning the techniques that attackers use
Everyone should be made aware that the old presently. I would say that it should be read by
division between trusted and untrusted zones everybody whose work depends on computers
and individuals can no longer be applied, that - well, at least some of the chapters.
network protocols offer many dangers be-
cause they are were not built with security in It says everything it should without the endless
mind and that every application has at least repeating and rephrasing so that readers
one vulnerability that can be exploited. It is not would understand the concept, because it was
necessary for everyone to know how to fix so clearly explained the first time. This is a
these problems, but in this case, a little para- book that will get and keep your attention, and
noia goes a long way. a must-read book for everyone dealing with
computer and information security.
Zeljka Zorz is a News Editor for Help Net Security and (IN)SECURE Magazine.
Sandra Toms LaPedis, Area Vice President and General Manager of RSA Con-
ferences, is responsible for global promotion and successful execution, in-
cluding strategy, brand extensions, content, marketing, logistics and partner-
ships for the Conference. In this Q&A she talks about what you can expect at
RSA Conference 2010 in San Francisco.
What's new in store for attendees of RSA SCADA and distributed/process control sys-
Conference 2010 in San Francisco this tems. Networks is now Network and Mobile
year? Security to include management of mobile de-
vices, mobile malware and how consumeriza-
The RSA Conference has more of what at- tion impacts mobile security.
tendees expect – more technical sessions,
relevant topics and case studies. Two new Additionally, Innovation Sandbox is back in
class tracks have been added this year: Data 2010! This popular half-day program, taking
Security and Security in Practice. Sessions in place on Monday, includes interactive white
the Data Security track cover strategies, prac- boarding sessions, ask the experts panels,
tices and technologies to classify, track and whisper suites, a serial entrepreneur panel –
protect sensitive data across the enterprise – plus an exciting demo area with a "top 10"
with partners, with outsourcers and with users. group of start-up companies. Innovation
The Security in Practice track will provide par- Sandbox – representing today's best new se-
ticipants with tangible examples of how large curity solutions – culminates with a shoot-out
enterprises solved hard security problems. among the top 10 start-ups as they present
their companies and products to a judging
We have also enhanced two existing tracks. panel comprised of venture capital profes-
Physical Security is now Physical Security and sionals, CISOs, CTOs and industry experts.
Critical Infrastructure to include topics such as
We are also working with SANS on delivering 21st Century Defense Initiative, Brookings In-
in-depth two-day training sessions pre- stitution, who will discuss, “The Robotics
Conference, as well as one-day sessions de- Revolution and 21st Century Conflict.” And a
livered by some of our best speakers. A new panel entitled “Dealing with Sophisticated
Security Basics Boot Camp one-day session Threats in Cyberspace without Creating Big
has been added for those new to the field, and Brother” will certainly be an interesting
focuses on the core security technologies that discussion of competing interests.
will be discussed during the week.
Moderated by Forbes Magazine National Edi-
Finally, weʼve added a new program on tor, Quentin Hardy, panelists include Richard
Thursday evening, just before the Codebreak- Clarke, former U.S. Cyber Security Czar; Mi-
ers Bash, called Pecha Kucha (PK) Happy chael Chertoff, former U.S. Secretary of the
Hour. Drawing its name from the Japanese Department of Homeland Security; and Marc
term for the sound of "chit chat," PK is a pres- Rotenberg, privacy expert with EPIC, a re-
entation format that is based on a simple idea: search center established to focus public at-
20 images x 20 seconds (total presentation tention on emerging civil liberties issues and
length: 6 minutes, 40 seconds). Presentations to protect privacy.
can be about information security or other-
wise, and the format demands a concise, fo- What tracks and workshops would you
cused approach in order to keep things mov- highlight?
ing at a rapid pace!
Hackers and Threats has always been a
How many attendees are you expecting for popular double track and the speaker lineup is
this edition of the conference? How many very impressive this year. Research Revealed
exhibitors? also highlights the underground economy,
new classes of vulnerabilities, exploitation
As the leading information security event with techniques, reverse engineering and how to
over 240 sessions, several thousand at- combat these problems. The Industry Experts
tendees and over 300 exhibitors are track features some of the most highly rated
anticipated. speakers from previous RSA Conference
sessions.
Who are the keynote speakers and what
topics are they discussing? And, as mentioned above, attendees should
be sure to attend Innovation Sandbox and the
Executives from the leading companies in in- Security Basics Boot Camp on Monday, in
formation security are keynoting, including addition to PK Happy Hour on Thursday.
representatives from Microsoft Corp., RSA
(The Security Division of EMC), Symantec Budgets are tight so what would you say
Corp., CA, Inc., IBM, McAfee, Inc., PGP to companies thinking about sending their
Corp., Qualys, Inc. and VeriSign, Inc. employees to RSA Conference?
The RSA Conference perennial favorite, the The cost of a public breach is much higher
Cryptographers Panel, will be moderated than the costs of attending the RSA Confer-
again by Ari Juels, Chief Scientist and Direc- ence. The benefits of learning from skilled
tor, RSA Labs, with panelists including Whit speakers, discovering innovative companies
Diffie, Visiting Professor, Royal Holloway Col- and sharing best practices with other organi-
lege, University of London, and Visiting zations facing the same challenges is invalu-
Scholar, Stanford University; Marty Hellman, able. Our attendees are increasingly charged
Professor Emeritus of Electrical Engineering, with making critical business and purchasing
Stanford University; Ron Rivest, the “R” in decisions that impact their organizationʼs se-
RSA; Adi Shamir, the “S” in RSA; and Brian curity posture – RSA Conference is the place
Snow, Former Technical Director, NSA IAD. to find new solutions and make deals.
Other stimulating keynotes sessions include

PW Singer, Senior Fellow and Director of the
Wireless LANs offer flexibility in accessing enterprise resources. Anyone with
a laptop or a smartphone has free access to network resources, since wire-
less systems use airwaves that extend beyond the physical perimeter of the
enterprise.
An increasing amount of incidents involving rity and a greater degree of access control.
data breaches, bandwidth stealing and denial What is required is a combination of secure
of service attacks on wireless networks have wireless clients, wireless infrastructure, and a
made it a business requirement to deploy se- network policy system that supports the latest
cure, authenticated wireless networks. Secu- encryption and authentication standards with
rity protocols such as Wired Equivalent Pri- granular, per-session access control.
vacy (WEP) and Wi-Fi Protected Access
(WPA) are outdated and it is no longer pru- Wireless security and the IEEE 802.1X
dent to expect that basic authentication and standard
encryption schemes such as those using pre-
shared keys are sufficient against todayʼs The most secure way of implementing wire-
more sophisticated attacks. less security is 802.1X, which is an IEEE
standard, used to authenticate access to both
Even though access control through the use wireless and wired networks. Enhanced secu-
of VLAN steering and ACLs has been avail- rity and access control provided by 802.1X
able at a port level on Ethernet switches, in includes support for centralized authentica-
many wireless deployments today the granu- tion, authorization, accounting and dynamic
larity of access control has been limited to the key management. 802.1X uses the Extensible
SSID-level VLAN, ACL and QoS settings. In Authentication Protocol (EAP) for message
many cases, this has resulted in parallel net- exchange during the authentication process,
work topologies in the enterprise – one for which means that it supports secure authenti-
wireless and the other for wired access. Wire- cation methods that make use of X.509 cer-
less network deployments must balance user tificates and passwords.
accessibility and mobility with hardened secu-
There are three components involved in typi- pre-shared key based wireless access to
cal 802.1X interactions: A supplicant (on the 802.1X based access, a phased deployment
client device), an authenticator (on the wire- is recommended.
less controller), and a backend authentication
server. A high level description of 802.1X in- Phase 1 – Secure access
teractions follows:
Step 1 - Wireless controller configuration
1. Secure authentication. When a wireless • Configure a subset of controllers with an
client (running a supplicant) attempts to con- SSID that requires 802.1X-based authentica-
nect to a wireless controller, the supplicant tion
and the authentication server negotiate a se- • Configure the authentication servers on the
cure TLS tunnel. controller (A policy/AAA server that terminates
RADIUS/EAP protocol)
In password based authentication, the client • Turn on RADIUS accounting by configuring
sends credentials to the authentication server RADIUS accounting servers, so authentica-
in the secure tunnel. In certificate based tions can be tracked.
authentication, the client presents its X.509
certificate. In both cases, the wireless control- Step 2 - Policy/AAA Server Configuration
ler forwards the packets between the suppli- • Add the controllers that were configured in
cant and the authentication server. Step 1 as RADIUS clients
• Configure the appropriate EAP methods for
2. Granular enforcement. On successful user authentication. Microsoft Windows and
authentication, the authentication server MAC OS X clients support the EAP-PEAP
sends a message to the wireless controller to [EAP-MSCHAPv2] method natively, so this is
permit or deny access. It can also send other a good choice for an authentication method.
network enforcement attributes such as Note that the authentication method you con-
VLAN, ACL, QoS, etc. Note that this enforce- figure also depends on the identity store in
ment is applied to network traffic from the which your user records are stored. Microsoft
authenticated client. Active Directory, for example, is compatible
with the MSCHAPv2 authentications.
3. Dynamic keys and data encryption. At • Configure the identity store for authentica-
the end of the authentication exchange, the tions. This is typically an enterprise directory
authentication server also sends a key (co- • Add a policy that permits access if authenti-
derived with the supplicant during the authen- cation is successful, and denies access
tication exchange) to the wireless controller; •otherwise.
this key is then used by the supplicant and the
wireless controller to derive dynamic session Step 3 - Client configuration
keys for data encryption. • Enable the native 802.1X supplicant on the
client computers. Microsoft Windows, MAC
As can be seen from the above flow, IEEE OS X and most Linux distributions have native
802.1X offers a framework for: support for 802.1X. Note that there are tools
available to ease this configuration process.
• Performing strong authentication • Enable single sign-on. The credentials that
• Generating dynamic keys for data encryp- are entered in the login window of the OS are
tion, and used as 802.1X authentication credentials.
• Enforcing granular access control in the This is supported on both Windows and MAC
network. OS X based computers.
Deploying 802.1X for employee access Expected benefits of a Phase 1 deployment

entail the following:
Employees in enterprises typically log in from
corporate managed devices (laptops, desk- • Secure authentication of all employees
tops). These managed devices can be config- • Dynamic keys for strong wireless data en-
ured to access the network via 802.1X with cryption
minimal effort. For a smooth transition from • Improved tracking of user access.
Phase 2 - Differentiated access Machine Authentication (extending em-
ployee access to include known devices)
Once Phase 1 is fully deployed, granular ac-
cess control based on roles of the employees In many enterprises, devices that the user
can be implemented. Depending on how your logs in from must be corporate approved de-
network is configured and the capabilities of vices. Machine authentication can be done
your wireless controller, granular access con- alongside with 802.1 X-based user authenti-
trol can range from role-based network seg- cations, and tied together by the backend pol-
mentation (VLAN), Access Control List (ACL) icy system. Machine authentication can be
and Qualify of Service (QoS), to a per-user done by verifying the presence of a machineʼs
stateful firewall. MAC address in an inventory database, or by
performing a separate 802.1X machine
If the right network design is in place, this authentication against an identity store that
phase requires configuration only on the has the “computer” account (For example, Mi-
policy/AAA server: crosoft Windows computer accounts in Active
Directory).
• Configure policy server to extract user at-
tributes from the identity store. The extracted Tackling guest access
identity attribute can be group, department,
title or any other attribute associated with Guests typically get a temporary username
user. and password to log into the network. They
• Configure policies to send access control are given restricted privileges to the network –
primitives (VLAN, ACL, etc.) to the wireless typically only Internet access. Since 802.1X
controller, based on one or more of the ex- requires computer configuration, enterprises
tracted identity attributes. typically do not enforce 802.1X-based access
for guests. So how is a wireless guest access
The benefit of deploying phase 2 is that users handled?
get access to network resources based on
their role in the organization. As users move Guest access configuration steps are outlined
around in the network, from building to build- below:
ing, their access permissions follow them
around. Step 1 - Wireless controller configuration
• Configure a guest SSID on the wireless con-
Phase 3 - Advanced access control trollers
• Optional data encryption can be configured
Differentiated access deployed in Phase 2 by requiring a WPA2 pre-shared key (which is
can be further enhanced by taking into con- handed out to the guest, along with the tem-
sideration other identity, health or session porary username and password)
based attributes. For example, the following • Access control for this SSID can be statically
are some of the attributes commonly used to configured (unless different guests get differ-
provide a finer degree of differentiated ac- ent levels of access, in which case policies
cess: need to be configured on the Policy/AAA
server)
• Time of day • Configure the authentication servers on the
• Location controller (A policy/AAA server that terminates
• Access type (wireless, wired) RADIUS protocol)
• Device OS and type (laptop vs. handheld) • Most controllers have a built-in guest portal
• Device health (Anti-Virus, Anti-Spyware) that acts as a captive portal. The look and feel
checks. Device health can be collected and of this portal can be customized. Most control-
evaluated by: lers also have support for a portal hosted on
" • An agent that is available in the OS an external “guest system”. This latter con-
(such as the Microsoft NAP Agent that is figuration has several advantages:
available with the Windows XP SP3, Windows " • A Portal can be used for wired, wireless
Vista and Windows 7) and VPN use cases.
" • A vendor-specific permanent agent.
" • Support for health checks by means of " • Unmanageable devices such as wire-
a dissolvable agent loaded through the portal. less printers and VoIP phones can also be
" • Portal customization can be on a cen- given access by combining MAC address
tral server, without having to distribute it to authentication with device fingerprinting.
multiple controllers. • Some devices such as the iPhone, Droid,
" • Ability to support a single landing page Nexus One, etc., natively support 802.1X.
and multiple portals (guest, contractor, part- These devices can be given access to the
ner, employee portals, for example) by attach- network if an enterprise user authenticates
ing to a single SSID. from these devices. The other option is to
have these devices go through a registration
Step 2 - Policy/AAA server configuration process, which registers their MAC address in
• Add the controllers that were configured in a database. Once registered, employees can
Step 1 as RADIUS clients access the network using 802.1X. (This en-
• Configure the identity store for authentica- sures that employee is accessing the network
tions. This is typically the database that is from a known and approved device).
resident on the server
• Configure sponsor accounts that allow per- Unmanaged device access configuration
mission to add guest accounts in the local da- steps are outlined below:
tabase
• Add a policy that permits access if authenti- Step 1 - Wireless controller configuration
cation is successful, and denies access oth- • Configure an SSID with MAC filtering en-
erwise. If granular access is required, config- abled
ure policies appropriately. •Optional data encryption can be configured
by requiring a WPA2 pre-shared key
In this flow, when guests associate with the •Access control for this SSID can be statically
“guest” SSID and bring up a browser and visit configured (unless different device types re-
any web site, they are redirected to the cap- quire different levels of access to the network)
tive portal. They enter their credentials and •Configure the authentication servers on the
get access. controller (A policy/AAA server that terminates
RADIUS protocol).
Handling unmanaged device access
Step 2 - Policy/AAA server configuration
Unmanaged devices are those that are not • Add the controllers that were configured in
managed by the enterprise. Laptops or other Step 1 as RADIUS clients
computing devices brought in by guests can • Configure the identity store or white lists for
be handled as described in the previous sec- MAC-based authentications. This is typically
tion. Access policies for other unmanaged de- the database that is resident on the server
vices – for example, those brought in by em- (An external device profiler that supports
ployees – can be handled in multiple ways: LDAP can also be used as identity store.)
• Add a policy that permits access if authenti-
• Users can register these devices (typically, a cation is successful, and denies access oth-
function provided by the policy server). Once erwise. If granular access based on device
registered, these devices are allowed access type is required, configure policies appropri-
into the network based on their MAC address. ately.
Any device that is not in the MAC address da-
tabase is denied access. 802.1X client-side deployment considera-
" • Some policy servers also have the cations
pability to perform device fingerprinting (by
port scanning or by using the services of an When deploying 802.1X-based authentication,
external device profiler). The access policy a few deployment hurdles need to be taken
then takes into account both the MAC ad- into account.
dress and the device fingerprinting informa-
tion. This makes MAC address spoofing much Modern operating systems have native sup-
harder. port for 802.1X, both for wired and wireless
access.
However, when rolling out 802.1X enterprise- Conclusion
wide, these supplicants need to be configured
with the right parameters (such as EAP As enterprises increasingly rely on wireless
method, single sign on, machine authentica- networks throughout their infrastructure as a
tion, CA certificate, fast-reconnect, to name a standard business practice, network adminis-
few). This is a tall order for most end users. trators must address the security issues that
accompany the technology. With the emer-
In Microsoft Windows-only environments that gence of the 802.1X standard, most network-
use Active Directory-based authentication, a ing equipment now offers the basic tools to
Group Policy Object (GPO) that configures address secure wireless access with a finer
these parameters can be provisioned. When degree of control.
the user logs in, the GPO is pushed to the cli-
ent and the 802.1X parameters are automati- In closing, without a strategy and the proper
cally configured. There are also third-party tools to manage these controls, security ad-
wizards that are not limited to deploying ministration becomes expensive, time con-
802.1X in Windows-only environments. suming, and potentially unreliable. The idea is
802.1X configuration for MAC OS X, Linux to think big, but definitely use a phased or
and some smart phones can also be de- adaptive deployment model that meets your
ployed. The goal is provide the IT team and immediate needs.
user with a trusted method for configuring an
endpoint and making that first 802.1X connec-
tion.
Santhosh Cheeniyil is the Founder and VP of Engineering of Avenda Systems (www.avendasys.com). He has
over 19 years of product design, development and management experience in the computer industry. Prior to
co-founding Avenda Systems, Santhosh was at Cisco Systems for over 7 years, where he was a Senior Man-
ager and Technical Leader in security, voice and network management technology groups; he led the design
and development of several successful products in the VoIP and network management areas. He was a
Principal Engineer at Devsoft Corporation, which was acquired by Cisco in 1998.
Sectool (www.net-security.org/software.php?id=700)
Sectool is a security tool for RPM based distributions. It can be used for security auditing and in-
trusion detection.
FreeRADIUS (www.net-security.org/software.php?id=193)
The FreeRADIUS Server Project is a high-performance and highly configurable RADIUS server. It
includes plug-in modules with support for MySQL, PostgreSQL, Oracle, IODBC, IBM DB2, MS-
SQL, Sybase, LDAP, Kerberos, EAP, PAM, MS-CHAP and MPPE, Digest authentication, Python,
X9.9, and many more.
Lansweeper (www.net-security.org/software.php?id=739)
Lansweeper is a powerful freeware solution to make a complete software, hardware, asset inven-
tory of your Windows network.
Tunnelier (www.net-security.org/software.php?id=181)
Tunnelier is a powerful SSH2 port forwarding client with many features.
As the breaches at Heartland Payment Processing Systems and Hannaford
Brothers have demonstrated, compliance with the Payment Card Industry
Data Security Standard (PCI DSS) does not guarantee bulletproof security. Fa-
vorable performance in an annual On-Site PCI Data Security Assessment or
Self-Assessment Questionnaire (SAQ) is simply a snapshot of a companyʼs
status at one point in time and not proof of ongoing compliance. For example,
Hannaford Bros received its PCI DSS compliance certification one day after it
had been made aware of a two-month long breach of its network.
The PCI Security Standards Council says that helps these market constituents save money
“compliance efforts must be a continuous on SAQs and audit / certification fees by
process of assessment and remediation to Qualifies Security Assessors (QSAs).
ensure safety of cardholder data.”
With cybercriminals becoming ever more in-
Given this advice, as well as the examples of ventive, approaching PCI compliance with a
post-compliancy breaches, the global retail project mentality with the simple goal of pass-
community and its service suppliers have ing the audit falls well short of actually attain-
been propelled into a new era for PCI DSS ing a secure operation. Ideally, a retailer
compliance management. Not only must the should know its PCI DSS compliance status
retailer, bank or payment processor achieve on a daily basis, be able to adapt to updates in
compliance at a fixed point in time, it must the standard, and ensure that employees are
also implement specific programs to manage educated on security policies and are follow-
and maintain compliance on an ongoing basis. ing them.
The concept of “Continuous Compliance”
To achieve this, retailers must shift their view needed for achieving and sustaining a high
of security and compliance from a checklist level of continuous compliance—and security.
mentality for passing an audit to a state of
continuous IT security. The GRC model
Permanent and uncompromising process dis- "GRC" refers to a class of automated systems
cipline must be instituted on the data security that help organizations integrate and control
domain to achieve consistent, effective protec- the management of complex regulatory man-
tion for the sensitive and confidential customer dates and operational risk in alignment with
information collected and stored. appropriate high level company governance.
While this may sound like a daunting task—e- GRC is a strategic approach to the universal
specially for smaller retail merchants—using concept of compliance. It can help retailers
an automated IT Governance, Risk and Com- meet PCI compliance requirements as well as
pliance (IT GRC) solution provides the type of providing a controls management framework
information and the security framework to protect other types of customer-confidential
information.
PERMANENT AND UNCOMPROMISING PROCESS DISCIPLINE MUST BE

INSTITUTED ON THE DATA SECURITY DOMAIN TO ACHIEVE CONSISTENT,
EFFECTIVE PROTECTION FOR THE SENSITIVE AND CONFIDENTIAL
CUSTOMER INFORMATION COLLECTED AND STORED.
The information security policy icy and acknowledges their responsibility in

protecting the organizationʼs information and
While many retailers approach PCI DSS com- data. GRC systems have Security Awareness
pliance as a technology problem, itʼs just as modules make it easy for retailers to educate
much a people problem. Simply installing the employees on general IT security practices
best firewall and encryption technologies is and internal IT security policies. The Aware-
just the first part of the solution. Following IT ness module also tracks who takes each
security best practices and establishing a writ- course and records test scores.
ten security policy is the next step, but if em-
ployees arenʼt following those policies the or- Business continuity planning
ganization remains vulnerable. According to
Deloitteʼs “The 6th Annual Global Security The impact of a data breach can be devastat-
Survey,” “people are the problem.” ing. IT GRC systems include a Business Con-
tinuity Planning (BCP) component that pro-
The report states that, “Human error is over- vides retailers with a single source repository
whelmingly stated as the greatest weakness for the guidance, information and plans nec-
this year (86%), followed by technology (a dis- essary to respond to a data breach incident.
tant 63%).” The Computing Technology Indus-
try Association, Inc. (CompTIA) echoes that Continuous PCI compliance for small mer-
assessment in its "Committing to Security: A chants
CompTIA Analysis of IT Security and the
Workforce," survey stating that, “Human error, Smaller merchants are an appealing target for
not technology, is the most significant cause of cybercriminals because they often do not have
IT security breaches.” the expertise to properly secure card holder
data. A GRC tool delivered as “Software as a
To reduce security risk cause by human error, Service” (SaaS), hosted at a remote location
a retailer must have a process for distributing and delivered over the Internet, makes it af-
its IT security policy and ensuring that each fordable and adaptable for any size merchant.
employee has read and understands the pol-
Technological complexities achieving PCI Cross-organizational coordination
compliance
A GRC systemʼs compliance workflow capabil-
The GRC model provides a centralized auto- ity allows retailers to delegate specific security
mated compliance workflow management and assignments to different employees across the
tracking system to handle the enormous num- organization, and to define specific completion
ber of tasks that need to be performed, coor- dates or specific intervals for repetitive tasks
dinated and analyzed to achieve PCI DSS for each technology control or business proc-
compliance and pass audits. Without auto- ess to meet the PCI DSS requirement to as-
mated management, control and oversight of sign tasks and accountability.
the total process of PCI compliance becomes
highly inefficient and costly. Total PCI compliance oversight
The many moving parts of PCI DSS IT GRC solutions provide total oversight of the
compliance entire PCI compliance process, including
technology-based components. It is an auto-
PCI DSS compliance is an ongoing manage- mated workflow optimized to manage and
ment challenge caused by changes in busi- monitors event and feedback information from
ness processes and technology, vendor- multiple components with an at-a-glance
supplied and third-party processor systems, summary, and assess and report on these
and security threats. In addition, the PCI stan- controls in every form needed, from installa-
dard evolves on a regular basis. Automated IT tion to the results produced. Automated IT
GRC tools enable retailers to respond to GRC tools can help retailers achieve a new
change by improving the planning cycle and level of security by creating a framework for
by organizing the relationships among poli- continuous data security improvement and
cies, people, technology controls and risk in- PCI DSS compliance while reducing the costs
formation. of compliance.
Joseph Dell is president of Lightwave Security (www.lightwvesecurity.com), an Atlanta-based GRC solution

provider and exclusive North American distributor for SecureAware. He can be reached at
jdell@lightwavesecurity.com.

(IN) SECURE Magazine Issue 24

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

(IN) SECURE Magazine Issue 24

Uploaded by

Copyright:

Available Formats

With a variety of high profile breaches like those at Google and Adobe dominating the start of

Visit the magazine website at www.insecuremag.com

(IN)SECURE Magazine contacts

Copyright HNS Consulting Ltd. 2010.

As regards malware distribution channels, social networks

Cybersecurity expert: Job guaranteed

Following a couple of announcements made in December by the likes of Travis Credit

Entrust updates PKI platform, adds Linux support

Continuing evolution of Internet threats

Spammers continue to be cutting-edge marketers,

Software testing firm says no to responsible disclosure

Evgeny Legerov, founder of Intevydis, a Moscow-based company that designs

Top 10 information security threats for 2010

Online cybercriminal DarkMarket closed, founder arrested

Who would have thought that Renukanth Subramaniam, a 33-year old

D-Link routers vulnerability allows hackers to reconfigure admin settings

SourceSec Security Research have discovered a vulnerability

Networks Solutions breached, hundreds of sites defaced

Encryption challenge worth $100K

Imperva released a study analyzing 32 million

Hiding from Google

Using spam to beat spam

Data breach costs increase

US oil industry targeted by cyber attacks

SecureWorks reported that attempted hacker attacks launched at its healthcare

Digital fingerprints to identify hackers

IE vulnerability offers your files to hackers

Tor Project infrastructure breached, users advised to upgrade

Criminal found through World of Warcraft

It seems that law enforcement agencies are getting more crea-

I have been working for a German telephone SOAP Web services

class SecureSoapClient extends SoapClient

// Create new XMLSecurityKey object and load private key

// Create new WSS header object

// Add Timestamp to WSS header (message expires in 5 minutes)

// Sign message and appropriate header items

// Create BinarySecurityToken from certificate and attach token to the header

// Send SOAP message with WSS header and return response

Conclusion Furthermore, HTTPS can help preparing a

Signature solutions While antivirus, anti-spyware and similar se-

PC-based security software is still critically important, but is

Firewalls When the user initiates an HTTP connection,

• A virtualization engine to creates a duplicate 3. Itʼs unobtrusive: no special setup or main-

Caroline Ikomi is the Technical Director at Check Point (www.checkpoint.com).

Configuration options 1Password preferences. Here you can set an

1Password Anywhere memory stick or put in online storage and

The problems 1Password on the iPhone

Conclusion The introduction of the iPhone Pro version in

• Compliance requirements. Rules and regula- A widespread approach to ranking applica-

Note: This is an over-simplified table intended to exemplify the mapping activity.

CompTIA's Network+ exam (N10-004) is a major update with more focus on

Inside Cyber Warfare: Mapping the Cyber Underworld

You'll learn how sophisticated hackers working on behalf of states or organized

The Official Ubuntu Book (4th Edition)

Eleventh Hour Security+

Hacking: The Next Generation

New applications, new threats These attacks will be localized, contextualized

Conclusion select the PDF category:

Our favorites for this issue are:

Most CIOs donʼt have a full accounting of all the equipment

Perform a security audit cause theyʼve got a specific tasks or is the

<rule id="5500" level="0" noalert="1">

<rule id="5501" level="3">